{"advisories":{"yourls\/yourls":[{"advisoryId":"PKSA-grvh-n5s5-5dmb","packageName":"yourls\/yourls","remoteId":"GHSA-f8ff-652m-j5rx","title":"YOURLS: Unauthenticated File Inclusion","link":"https:\/\/github.com\/advisories\/GHSA-f8ff-652m-j5rx","cve":"CVE-2026-62858","affectedVersions":"\u003C=1.10.4","source":"GitHub","reportedAt":"2026-10-15 20:13:02","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-f8ff-652m-j5rx"}]}],"leantime\/leantime":[{"advisoryId":"PKSA-vxb4-5j8y-5cbx","packageName":"leantime\/leantime","remoteId":"GHSA-54mm-6729-r5wp","title":"Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods","link":"https:\/\/github.com\/advisories\/GHSA-54mm-6729-r5wp","cve":"CVE-2026-85990","affectedVersions":"\u003C3.10.0","source":"GitHub","reportedAt":"2026-10-15 20:14:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-54mm-6729-r5wp"}]}],"react\/http":[{"advisoryId":"PKSA-y8pw-63n4-d3gg","packageName":"react\/http","remoteId":"GHSA-g4f2-2pf3-2pwj","title":"react\/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","link":"https:\/\/github.com\/advisories\/GHSA-g4f2-2pf3-2pwj","cve":"CVE-2026-104827","affectedVersions":"\u003E=1.0.0,\u003C=1.11.0","source":"GitHub","reportedAt":"2026-10-15 20:09:56","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-g4f2-2pf3-2pwj"}]},{"advisoryId":"PKSA-2zvc-7x4m-kphn","packageName":"react\/http","remoteId":"react\/http\/GHSA-g4f2-2pf3-2pwj.yaml","title":"Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react\/http","link":"https:\/\/github.com\/reactphp\/http\/security\/advisories\/GHSA-g4f2-2pf3-2pwj","cve":null,"affectedVersions":"\u003E=1.0.0,\u003C1.11.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-09 09:11:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"react\/http\/GHSA-g4f2-2pf3-2pwj.yaml"}]},{"advisoryId":"PKSA-7xc4-r5ry-fg9s","packageName":"react\/http","remoteId":"react\/http\/CVE-2026-84997.yaml","title":"A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU","link":"https:\/\/github.com\/reactphp\/http\/security\/advisories\/GHSA-x424-64qh-5j54","cve":"CVE-2026-84997","affectedVersions":"\u003E=0.6.0,\u003C1.11.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-09 09:11:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-x424-64qh-5j54"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"react\/http\/CVE-2026-84997.yaml"}]}],"symfony\/http-foundation":[{"advisoryId":"PKSA-xmwy-rmx5-m7h4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml"}]}],"symfony\/symfony":[{"advisoryId":"PKSA-fyjn-dgwp-4tt3","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml"}]},{"advisoryId":"PKSA-zxg3-vspd-sr38","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml"}]},{"advisoryId":"PKSA-5gdh-tt4n-ckh2","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml"}]}],"symfony\/yaml":[{"advisoryId":"PKSA-xz3r-9gp4-4m1z","packageName":"symfony\/yaml","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml"}]}],"symfony\/expression-language":[{"advisoryId":"PKSA-vq1j-sc3k-jzzk","packageName":"symfony\/expression-language","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml"}]}],"aptoma\/twig-markdown":[{"advisoryId":"PKSA-pth7-jz73-t51g","packageName":"aptoma\/twig-markdown","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-APTOMATWIGMARKDOWN-8400480","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.4.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-10-31 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml"}]}],"pattern-lab\/drupal-twig-components":[{"advisoryId":"PKSA-xhgb-v99m-4h6n","packageName":"pattern-lab\/drupal-twig-components","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-PATTERNLABDRUPALTWIGCOMPONENTS-8400872","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=2.2.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml"}]}],"j0k3r\/httplug-ssrf-plugin":[{"advisoryId":"PKSA-px1b-j2dd-31r6","packageName":"j0k3r\/httplug-ssrf-plugin","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml","title":"Server-side Request Forgery (SSRF)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-J0K3RHTTPLUGSSRFPLUGIN-8400871","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/add-attributes-twig-extension":[{"advisoryId":"PKSA-wczj-fvbh-sqgr","packageName":"drupal-pattern-lab\/add-attributes-twig-extension","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABADDATTRIBUTESTWIGEXTENSION-8400879","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/bem-twig-extension":[{"advisoryId":"PKSA-9j51-377g-2f4j","packageName":"drupal-pattern-lab\/bem-twig-extension","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABBEMTWIGEXTENSION-8400878","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/unified-twig-extensions":[{"advisoryId":"PKSA-13v9-rks1-fwdd","packageName":"drupal-pattern-lab\/unified-twig-extensions","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=0.1.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml"}]}],"typo3\/cms-form":[{"advisoryId":"PKSA-fykt-pmbg-txnv","packageName":"typo3\/cms-form","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml","title":"TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-024","cve":"CVE-2026-109162","affectedVersions":"\u003E=14.0.0,\u003C14.3.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-13 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml"}]},{"advisoryId":"PKSA-d4vj-m6hn-xm1j","packageName":"typo3\/cms-form","remoteId":"typo3\/cms-form\/CVE-2026-15305.yaml","title":"TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-020","cve":"CVE-2026-15305","affectedVersions":"\u003E=14.2.0,\u003C14.3.5","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-07-14 12:08:47","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mfqj-cqv3-h7xw"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-form\/CVE-2026-15305.yaml"}]}],"contao\/comments-bundle":[{"advisoryId":"PKSA-c42s-m9fj-8jxw","packageName":"contao\/comments-bundle","remoteId":"GHSA-628f-v4f6-p37r","title":"Contao: Cross-site scripting in the comments bundle","link":"https:\/\/github.com\/advisories\/GHSA-628f-v4f6-p37r","cve":"CVE-2026-107845","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-628f-v4f6-p37r"}]}],"contao\/core-bundle":[{"advisoryId":"PKSA-b5qj-hq3z-3ry8","packageName":"contao\/core-bundle","remoteId":"GHSA-5974-gfqc-wrcm","title":"Contao: Improper access control in the table access voter","link":"https:\/\/github.com\/advisories\/GHSA-5974-gfqc-wrcm","cve":"CVE-2026-107851","affectedVersions":"\u003E=5.7.0,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:42","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5974-gfqc-wrcm"}]},{"advisoryId":"PKSA-7n2q-445d-xssj","packageName":"contao\/core-bundle","remoteId":"GHSA-q6wp-fr43-gm9v","title":"Contao: Improper access control in the preview links module","link":"https:\/\/github.com\/advisories\/GHSA-q6wp-fr43-gm9v","cve":"CVE-2026-107850","affectedVersions":"\u003E=5.7.1,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:46","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q6wp-fr43-gm9v"}]},{"advisoryId":"PKSA-6j5h-bxmj-94h9","packageName":"contao\/core-bundle","remoteId":"GHSA-mrvp-7wmx-5m4h","title":"Contao: Path traversal in the images controller","link":"https:\/\/github.com\/advisories\/GHSA-mrvp-7wmx-5m4h","cve":"CVE-2026-107844","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:55","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mrvp-7wmx-5m4h"}]},{"advisoryId":"PKSA-6ymc-kdpm-qx87","packageName":"contao\/core-bundle","remoteId":"GHSA-9ff2-p842-45wq","title":"Contao: Cross-site request forgery in custom backend actions","link":"https:\/\/github.com\/advisories\/GHSA-9ff2-p842-45wq","cve":"CVE-2026-107848","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-9ff2-p842-45wq"}]},{"advisoryId":"PKSA-s71c-hg32-kv3f","packageName":"contao\/core-bundle","remoteId":"GHSA-mfxh-vp55-7gc6","title":"Contao: The registration module re-sends activation mails","link":"https:\/\/github.com\/advisories\/GHSA-mfxh-vp55-7gc6","cve":"CVE-2026-107843","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mfxh-vp55-7gc6"}]},{"advisoryId":"PKSA-bmqh-y7sv-p1st","packageName":"contao\/core-bundle","remoteId":"GHSA-x2rp-9qf7-2fmq","title":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled","link":"https:\/\/github.com\/advisories\/GHSA-x2rp-9qf7-2fmq","cve":"CVE-2026-107842","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:09","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x2rp-9qf7-2fmq"}]},{"advisoryId":"PKSA-yx24-z15d-x2k7","packageName":"contao\/core-bundle","remoteId":"contao\/core-bundle\/CVE-2026-57232.yaml","title":"Server-side request forgery (SSRF) via unvalidated RSS feed URLs","link":"https:\/\/contao.org\/en\/security-advisories\/server-side-request-forgery-via-unvalidated-rss-feed-urls","cve":"CVE-2026-57232","affectedVersions":"\u003E=5.3.35,\u003C5.3.48|\u003E=5.4.0,\u003C5.7.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-07-13 09:10:22","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"contao\/core-bundle\/CVE-2026-57232.yaml"},{"name":"GitHub","remoteId":"GHSA-87mg-5grr-rhwh"}]}],"enshrined\/svg-sanitize":[{"advisoryId":"PKSA-cbx2-m9db-bmzd","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-v383-3rw5-q8rf","title":"enshrined\/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","link":"https:\/\/github.com\/advisories\/GHSA-v383-3rw5-q8rf","cve":"CVE-2026-107379","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:05","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-v383-3rw5-q8rf"}]},{"advisoryId":"PKSA-6j95-1jtb-x6wc","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-m9xh-6747-9r6f","title":"svg-sanitizer: Mixed-case xlink:HrEf skips the `\u003Cuse\u003E` nesting-DoS check in Resolver::processReferences","link":"https:\/\/github.com\/advisories\/GHSA-m9xh-6747-9r6f","cve":"CVE-2026-107381","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-m9xh-6747-9r6f"}]},{"advisoryId":"PKSA-8j6w-3kr7-s9xk","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-9rjx-3jch-6vjf","title":"enshrined\/svg-sanitize: Stored XSS via DTD Entity \/ HTML5 Named Character Reference Collision","link":"https:\/\/github.com\/advisories\/GHSA-9rjx-3jch-6vjf","cve":"CVE-2026-107380","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:15","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9rjx-3jch-6vjf"}]}],"kunstmaan\/media-bundle":[{"advisoryId":"PKSA-qzt5-rxz6-8qm6","packageName":"kunstmaan\/media-bundle","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"kunstmaan\/bundles-cms":[{"advisoryId":"PKSA-c8mp-7f4z-q7q5","packageName":"kunstmaan\/bundles-cms","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"ueberdosis\/tiptap-php":[{"advisoryId":"PKSA-52qp-479k-9x2j","packageName":"ueberdosis\/tiptap-php","remoteId":"GHSA-4595-7fjw-r3jh","title":"Tiptap contains an input validation vulnerability resulting in DoS","link":"https:\/\/github.com\/advisories\/GHSA-4595-7fjw-r3jh","cve":"CVE-2026-47110","affectedVersions":"\u003C2.1.1","source":"GitHub","reportedAt":"2026-06-25 00:33:22","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-4595-7fjw-r3jh"}]}],"filament\/filament":[{"advisoryId":"PKSA-cnr1-6g7k-bp3d","packageName":"filament\/filament","remoteId":"GHSA-7m6h-rg42-m449","title":"Filament: Multi-factor authentication (app) management actions do not require password reauthentication","link":"https:\/\/github.com\/advisories\/GHSA-7m6h-rg42-m449","cve":"CVE-2026-104181","affectedVersions":"\u003E=5.0.0,\u003C5.8.2|\u003E=4.0.0,\u003C4.13.2","source":"GitHub","reportedAt":"2026-10-05 23:44:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7m6h-rg42-m449"}]},{"advisoryId":"PKSA-wst7-5d23-qy5j","packageName":"filament\/filament","remoteId":"GHSA-52xp-w8hr-xv3c","title":"Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled","link":"https:\/\/github.com\/advisories\/GHSA-52xp-w8hr-xv3c","cve":"CVE-2026-77567","affectedVersions":"\u003E=5.0.0,\u003C5.7.0|\u003E=4.0.0,\u003C4.12.0","source":"GitHub","reportedAt":"2026-09-01 21:28:47","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-52xp-w8hr-xv3c"}]},{"advisoryId":"PKSA-r2v2-7j3d-th1m","packageName":"filament\/filament","remoteId":"GHSA-xwpv-pqxp-5v36","title":"Filament: Password validity disclosure for accounts denied panel access on login page","link":"https:\/\/github.com\/advisories\/GHSA-xwpv-pqxp-5v36","cve":"CVE-2026-84307","affectedVersions":"\u003E=5.0.0,\u003C5.7.5|\u003E=4.0.0,\u003C4.12.5","source":"GitHub","reportedAt":"2026-09-01 21:29:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-xwpv-pqxp-5v36"}]},{"advisoryId":"PKSA-fwm5-nrzy-yd41","packageName":"filament\/filament","remoteId":"GHSA-r3j6-gpjw-qfjr","title":"Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used","link":"https:\/\/github.com\/advisories\/GHSA-r3j6-gpjw-qfjr","cve":"CVE-2026-84306","affectedVersions":"\u003E=5.0.0,\u003C5.7.6|\u003E=4.0.0,\u003C4.12.6","source":"GitHub","reportedAt":"2026-09-01 21:29:43","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-r3j6-gpjw-qfjr"}]}],"mongodb\/mongodb":[{"advisoryId":"PKSA-y93m-jgy6-r9ns","packageName":"mongodb\/mongodb","remoteId":"GHSA-8fxw-fmj8-xp7j","title":"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs","link":"https:\/\/github.com\/advisories\/GHSA-8fxw-fmj8-xp7j","cve":"CVE-2026-88023","affectedVersions":"\u003E=2.0.0,\u003C2.4.2|\u003E=1.1.0,\u003C1.21.5","source":"GitHub","reportedAt":"2026-10-05 23:26:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-8fxw-fmj8-xp7j"}]},{"advisoryId":"PKSA-61k5-cqr9-b8b4","packageName":"mongodb\/mongodb","remoteId":"GHSA-65fr-j4p9-vc33","title":"mongodb: Reject \u0022.\u0022 and NUL bytes in database and collection names","link":"https:\/\/github.com\/advisories\/GHSA-65fr-j4p9-vc33","cve":"CVE-2026-81525","affectedVersions":"\u003E=2.0.0,\u003C2.4.1|\u003C1.21.4","source":"GitHub","reportedAt":"2026-09-08 21:27:42","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-65fr-j4p9-vc33"}]}],"composer\/composer":[{"advisoryId":"PKSA-ddsx-fjz2-sbs3","packageName":"composer\/composer","remoteId":"GHSA-96h3-5x6v-m776","title":"Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path","link":"https:\/\/github.com\/advisories\/GHSA-96h3-5x6v-m776","cve":"CVE-2026-59944","affectedVersions":"\u003E=1.0,\u003C2.2.30|\u003E=2.3.0,\u003C2.10.3","source":"GitHub","reportedAt":"2026-10-02 19:14:34","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-96h3-5x6v-m776"}]},{"advisoryId":"PKSA-ym19-cy3j-z6df","packageName":"composer\/composer","remoteId":"GHSA-rvx4-ffvw-m9q3","title":"Composer arbitrary command execution via a malicious package\u0027s Perforce source URL","link":"https:\/\/github.com\/advisories\/GHSA-rvx4-ffvw-m9q3","cve":"CVE-2026-84361","affectedVersions":"\u003E=1.0,\u003C2.2.30|\u003E=2.3.0,\u003C2.10.3","source":"GitHub","reportedAt":"2026-09-08 21:25:41","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-rvx4-ffvw-m9q3"}]}],"league\/commonmark":[{"advisoryId":"PKSA-m4t9-vsgq-8khn","packageName":"league\/commonmark","remoteId":"GHSA-3q6v-r5mr-hxv8","title":"league\/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan","link":"https:\/\/github.com\/advisories\/GHSA-3q6v-r5mr-hxv8","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:13","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3q6v-r5mr-hxv8"}]},{"advisoryId":"PKSA-m2dq-1fhr-29b1","packageName":"league\/commonmark","remoteId":"GHSA-97jj-33gv-5xf9","title":"league\/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal","link":"https:\/\/github.com\/advisories\/GHSA-97jj-33gv-5xf9","cve":null,"affectedVersions":"\u003E=1.3.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:33","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-97jj-33gv-5xf9"}]},{"advisoryId":"PKSA-nv44-1b4d-6gjg","packageName":"league\/commonmark","remoteId":"GHSA-jjv6-8j6v-6j52","title":"league\/commonmark: Denial of service in the SmartPunct and Attributes extensions","link":"https:\/\/github.com\/advisories\/GHSA-jjv6-8j6v-6j52","cve":null,"affectedVersions":"\u003E=1.5.0,\u003C2.9.1","source":"GitHub","reportedAt":"2026-09-01 20:21:45","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-jjv6-8j6v-6j52"}]},{"advisoryId":"PKSA-zyf5-hrxv-hrd7","packageName":"league\/commonmark","remoteId":"GHSA-8rr7-cvq3-gmfh","title":"league\/commonmark: Denial of service via distinctly-named attributes in the Attributes extension","link":"https:\/\/github.com\/advisories\/GHSA-8rr7-cvq3-gmfh","cve":null,"affectedVersions":"\u003E=1.5.0,\u003C2.10.0","source":"GitHub","reportedAt":"2026-09-01 20:28:40","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-8rr7-cvq3-gmfh"}]},{"advisoryId":"PKSA-kr3s-894t-g5w2","packageName":"league\/commonmark","remoteId":"GHSA-f8fg-pg57-v4j8","title":"league\/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed","link":"https:\/\/github.com\/advisories\/GHSA-f8fg-pg57-v4j8","cve":null,"affectedVersions":"\u003E=2.7.0,\u003C2.9.1","source":"GitHub","reportedAt":"2026-09-01 20:18:29","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f8fg-pg57-v4j8"}]},{"advisoryId":"PKSA-9q1p-3s19-bp1q","packageName":"league\/commonmark","remoteId":"GHSA-j8pm-gj4c-rq4x","title":"league\/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters","link":"https:\/\/github.com\/advisories\/GHSA-j8pm-gj4c-rq4x","cve":null,"affectedVersions":"\u003E=0.6.0,\u003C2.9.1","source":"GitHub","reportedAt":"2026-09-01 20:17:59","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-j8pm-gj4c-rq4x"}]}],"jayanta\/laravel-threat-detection":[{"advisoryId":"PKSA-fq5s-jjn9-17wq","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml","title":"Credentials under prefixed or nested names stored in cleartext in the threat log","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-6gg9-q48h-56vx","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml"}]},{"advisoryId":"PKSA-1nr4-5xd6-jgjp","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml","title":"Plaintext credentials written to the threat log and readable by any authenticated user","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-9jh8-pj82-6ccg","cve":null,"affectedVersions":"\u003C1.8.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-06 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml"}]},{"advisoryId":"PKSA-j8sb-5q45-xtvw","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml","title":"Attacks go unrecorded when a request carries malformed headers or oversized fields","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-3c4c-m8xj-3vc8","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml"}]},{"advisoryId":"PKSA-grsv-gc9r-djpk","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml","title":"Marking a detection as a false positive could create a wider exclusion rule than intended","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-rppj-hxxm-v5pr","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml"}]}],"phpseclib\/phpseclib":[{"advisoryId":"PKSA-12sz-bcny-pk4m","packageName":"phpseclib\/phpseclib","remoteId":"GHSA-q97c-8qh3-fpc6","title":"phpseclib \u2014 non-constant-time X25519 scalar multiplication permits full private-key recovery","link":"https:\/\/github.com\/advisories\/GHSA-q97c-8qh3-fpc6","cve":"CVE-2026-84308","affectedVersions":"\u003E=4.0.0,\u003C4.0.1|\u003C3.0.57","source":"GitHub","reportedAt":"2026-09-08 21:24:29","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q97c-8qh3-fpc6"}]}],"laravel\/framework":[{"advisoryId":"PKSA-d5tc-s1qs-h781","packageName":"laravel\/framework","remoteId":"GHSA-jh5r-qr3c-85q8","title":"Laravel: XSS in Debug Page Information","link":"https:\/\/github.com\/advisories\/GHSA-jh5r-qr3c-85q8","cve":"CVE-2026-102279","affectedVersions":"\u003E=13.0.0,\u003C13.30.0|\u003C12.69.0","source":"GitHub","reportedAt":"2026-09-29 18:24:25","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-jh5r-qr3c-85q8"}]}],"league\/flysystem":[{"advisoryId":"PKSA-w9tt-7782-78jx","packageName":"league\/flysystem","remoteId":"GHSA-cxf4-7mrp-vvpr","title":"Flysystem: WhitespacePathNormalizer\u0027s control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter","link":"https:\/\/github.com\/advisories\/GHSA-cxf4-7mrp-vvpr","cve":"CVE-2026-102601","affectedVersions":"\u003C=3.35.2","source":"GitHub","reportedAt":"2026-09-29 18:10:14","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-cxf4-7mrp-vvpr"}]}],"fof\/oauth":[{"advisoryId":"PKSA-4zg4-dqk9-5wt7","packageName":"fof\/oauth","remoteId":"GHSA-g7vj-c29h-3h5m","title":"FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider","link":"https:\/\/github.com\/advisories\/GHSA-g7vj-c29h-3h5m","cve":"CVE-2026-92161","affectedVersions":"\u003E=2.0.0-beta.1,\u003C2.0.0-beta.4|\u003C1.7.4","source":"GitHub","reportedAt":"2026-09-25 15:55:07","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-g7vj-c29h-3h5m"}]}],"code16\/sharp":[{"advisoryId":"PKSA-p6zx-3z97-z7f8","packageName":"code16\/sharp","remoteId":"GHSA-vj3q-vp3g-j9c8","title":"code16\/sharp has a stored XSS via data-html-content Sanitizer Bypass","link":"https:\/\/github.com\/advisories\/GHSA-vj3q-vp3g-j9c8","cve":"CVE-2026-61825","affectedVersions":"\u003C9.22.5","source":"GitHub","reportedAt":"2026-09-25 15:00:44","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-vj3q-vp3g-j9c8"}]},{"advisoryId":"PKSA-735v-pwws-tf2j","packageName":"code16\/sharp","remoteId":"GHSA-qxg3-46rw-79j8","title":"code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute","link":"https:\/\/github.com\/advisories\/GHSA-qxg3-46rw-79j8","cve":"CVE-2026-61823","affectedVersions":"\u003C9.22.5","source":"GitHub","reportedAt":"2026-09-25 15:02:11","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-qxg3-46rw-79j8"}]}],"starcitizenwiki\/embedvideo":[{"advisoryId":"PKSA-1f7b-5f9b-ggt9","packageName":"starcitizenwiki\/embedvideo","remoteId":"GHSA-v65j-hff3-753c","title":"Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled","link":"https:\/\/github.com\/advisories\/GHSA-v65j-hff3-753c","cve":"CVE-2026-57440","affectedVersions":"\u003C=4.0.0","source":"GitHub","reportedAt":"2026-09-25 15:03:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-v65j-hff3-753c"}]}],"zbateson\/mail-mime-parser":[{"advisoryId":"PKSA-r8x8-972m-nrc1","packageName":"zbateson\/mail-mime-parser","remoteId":"GHSA-f6v3-2qmr-vfjx","title":"zbateson\/mail-mime-parser has uncontrolled resource consumption (CPU\/memory DoS) parsing untrusted MIME","link":"https:\/\/github.com\/advisories\/GHSA-f6v3-2qmr-vfjx","cve":"CVE-2026-61816","affectedVersions":"\u003E=4.0.0,\u003C4.0.2|\u003E=2.0.0,\u003C3.0.6","source":"GitHub","reportedAt":"2026-09-24 19:45:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f6v3-2qmr-vfjx"}]},{"advisoryId":"PKSA-f3bq-hwxm-x4yf","packageName":"zbateson\/mail-mime-parser","remoteId":"GHSA-36h5-qg4p-q2qf","title":"zbateson\/mail-mime-parser has CRLF header injection via attachment filename","link":"https:\/\/github.com\/advisories\/GHSA-36h5-qg4p-q2qf","cve":"CVE-2026-61815","affectedVersions":"\u003E=4.0.0,\u003C4.0.2|\u003C3.0.6","source":"GitHub","reportedAt":"2026-09-24 19:46:32","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-36h5-qg4p-q2qf"}]}],"phpmyfaq\/phpmyfaq":[{"advisoryId":"PKSA-5kfv-yxk9-ft5p","packageName":"phpmyfaq\/phpmyfaq","remoteId":"GHSA-rw77-vq4g-x3hp","title":"phpMyFAQ has SQL Injection in `StopWords::add()` \u2014 Unescaped Stop Word Insertion","link":"https:\/\/github.com\/advisories\/GHSA-rw77-vq4g-x3hp","cve":"CVE-2026-56738","affectedVersions":"\u003C=4.1.5","source":"GitHub","reportedAt":"2026-09-24 19:30:07","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-rw77-vq4g-x3hp"}]},{"advisoryId":"PKSA-rrfb-2zp9-ws1j","packageName":"phpmyfaq\/phpmyfaq","remoteId":"GHSA-pgwp-vc7q-cvj3","title":"phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission","link":"https:\/\/github.com\/advisories\/GHSA-pgwp-vc7q-cvj3","cve":"CVE-2026-56736","affectedVersions":"\u003C4.2.0-alpha","source":"GitHub","reportedAt":"2026-09-24 19:28:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-pgwp-vc7q-cvj3"}]},{"advisoryId":"PKSA-tcxy-t63n-k6vh","packageName":"phpmyfaq\/phpmyfaq","remoteId":"GHSA-8gpw-xvpf-hvx5","title":"phpMyFAQ\u0027s two-factor authentication login bypasses the password factor","link":"https:\/\/github.com\/advisories\/GHSA-8gpw-xvpf-hvx5","cve":"CVE-2026-56737","affectedVersions":"\u003E=3.2.0,\u003C4.1.6","source":"GitHub","reportedAt":"2026-09-24 19:29:27","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-8gpw-xvpf-hvx5"}]}],"thorsten\/phpmyfaq":[{"advisoryId":"PKSA-mq9q-wz1h-jkfd","packageName":"thorsten\/phpmyfaq","remoteId":"GHSA-rw77-vq4g-x3hp","title":"phpMyFAQ has SQL Injection in `StopWords::add()` \u2014 Unescaped Stop Word Insertion","link":"https:\/\/github.com\/advisories\/GHSA-rw77-vq4g-x3hp","cve":"CVE-2026-56738","affectedVersions":"\u003C=4.1.5","source":"GitHub","reportedAt":"2026-09-24 19:30:07","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-rw77-vq4g-x3hp"}]},{"advisoryId":"PKSA-xsdh-jbbj-vv28","packageName":"thorsten\/phpmyfaq","remoteId":"GHSA-pgwp-vc7q-cvj3","title":"phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission","link":"https:\/\/github.com\/advisories\/GHSA-pgwp-vc7q-cvj3","cve":"CVE-2026-56736","affectedVersions":"\u003C4.2.0-alpha","source":"GitHub","reportedAt":"2026-09-24 19:28:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-pgwp-vc7q-cvj3"}]},{"advisoryId":"PKSA-p9tj-4psw-jkcc","packageName":"thorsten\/phpmyfaq","remoteId":"GHSA-8gpw-xvpf-hvx5","title":"phpMyFAQ\u0027s two-factor authentication login bypasses the password factor","link":"https:\/\/github.com\/advisories\/GHSA-8gpw-xvpf-hvx5","cve":"CVE-2026-56737","affectedVersions":"\u003E=3.2.0,\u003C4.1.6","source":"GitHub","reportedAt":"2026-09-24 19:29:27","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-8gpw-xvpf-hvx5"}]}],"snipe\/snipe-it":[{"advisoryId":"PKSA-z11q-y2hq-4dm3","packageName":"snipe\/snipe-it","remoteId":"GHSA-9vh6-qfv6-vcqp","title":"snipe-IT vulnerable to host header injection","link":"https:\/\/github.com\/advisories\/GHSA-9vh6-qfv6-vcqp","cve":"CVE-2022-23064","affectedVersions":"\u003E=3.0-alpha,\u003C=5.3.7","source":"GitHub","reportedAt":"2022-05-03 00:00:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-9vh6-qfv6-vcqp"}]},{"advisoryId":"PKSA-t5db-tq3m-tn97","packageName":"snipe\/snipe-it","remoteId":"GHSA-p9h3-gvpq-5539","title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","link":"https:\/\/github.com\/advisories\/GHSA-p9h3-gvpq-5539","cve":"CVE-2026-62368","affectedVersions":"\u003C8.7.0","source":"GitHub","reportedAt":"2026-09-24 18:19:30","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p9h3-gvpq-5539"}]},{"advisoryId":"PKSA-yjnz-vzp8-t7f6","packageName":"snipe\/snipe-it","remoteId":"GHSA-396x-xmvh-p563","title":"Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API","link":"https:\/\/github.com\/advisories\/GHSA-396x-xmvh-p563","cve":"CVE-2026-63498","affectedVersions":"\u003C8.7.0","source":"GitHub","reportedAt":"2026-09-24 18:19:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-396x-xmvh-p563"}]},{"advisoryId":"PKSA-2634-9r51-kjsx","packageName":"snipe\/snipe-it","remoteId":"GHSA-hxcx-9h4f-42xx","title":"Snipe-IT: 2FA bypass via the API token flow","link":"https:\/\/github.com\/advisories\/GHSA-hxcx-9h4f-42xx","cve":"CVE-2026-63493","affectedVersions":"\u003C8.7.0","source":"GitHub","reportedAt":"2026-09-24 16:38:27","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-hxcx-9h4f-42xx"}]},{"advisoryId":"PKSA-g91f-rycz-yjcf","packageName":"snipe\/snipe-it","remoteId":"GHSA-c6w2-j4wq-mvwg","title":"Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode","link":"https:\/\/github.com\/advisories\/GHSA-c6w2-j4wq-mvwg","cve":"CVE-2026-55643","affectedVersions":"\u003C8.6.3","source":"GitHub","reportedAt":"2026-08-19 19:32:11","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-c6w2-j4wq-mvwg"}]}],"redaxo\/source":[{"advisoryId":"PKSA-61tb-yjv2-q4wp","packageName":"redaxo\/source","remoteId":"GHSA-4f5f-j737-pm58","title":"REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration","link":"https:\/\/github.com\/advisories\/GHSA-4f5f-j737-pm58","cve":"CVE-2026-62998","affectedVersions":"\u003C=5.21.1","source":"GitHub","reportedAt":"2026-09-24 14:57:07","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-4f5f-j737-pm58"}]},{"advisoryId":"PKSA-hspm-hyxh-6wd5","packageName":"redaxo\/source","remoteId":"GHSA-mf2p-wjp4-99pq","title":"REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`","link":"https:\/\/github.com\/advisories\/GHSA-mf2p-wjp4-99pq","cve":"CVE-2026-63001","affectedVersions":"\u003C=5.21.1","source":"GitHub","reportedAt":"2026-09-23 14:04:40","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mf2p-wjp4-99pq"}]},{"advisoryId":"PKSA-hw96-c37g-vqkw","packageName":"redaxo\/source","remoteId":"GHSA-w998-qmw9-mf4m","title":"REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames","link":"https:\/\/github.com\/advisories\/GHSA-w998-qmw9-mf4m","cve":"CVE-2026-63002","affectedVersions":"\u003C=5.21.1","source":"GitHub","reportedAt":"2026-09-23 14:06:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-w998-qmw9-mf4m"}]},{"advisoryId":"PKSA-759m-q6p6-jn53","packageName":"redaxo\/source","remoteId":"GHSA-m8r3-22v6-g877","title":"REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates","link":"https:\/\/github.com\/advisories\/GHSA-m8r3-22v6-g877","cve":"CVE-2026-63000","affectedVersions":"\u003C=5.21.1","source":"GitHub","reportedAt":"2026-09-23 14:09:15","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-m8r3-22v6-g877"}]}],"verbb\/formie":[{"advisoryId":"PKSA-4fhy-ttgn-65dd","packageName":"verbb\/formie","remoteId":"GHSA-9rg8-2wvr-fgjh","title":"Formie: Missing authorization on sent notification resend modal exposes submission PII","link":"https:\/\/github.com\/advisories\/GHSA-9rg8-2wvr-fgjh","cve":"CVE-2026-76089","affectedVersions":"\u003C2.2.23|\u003E=3.0.0,\u003C3.1.31","source":"GitHub","reportedAt":"2026-09-23 21:24:01","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-9rg8-2wvr-fgjh"}]},{"advisoryId":"PKSA-mwqg-ntj6-7bx8","packageName":"verbb\/formie","remoteId":"GHSA-v3f3-cmj4-cvj9","title":"Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials","link":"https:\/\/github.com\/advisories\/GHSA-v3f3-cmj4-cvj9","cve":"CVE-2026-76086","affectedVersions":"\u003C2.2.23|\u003E=3.0.0,\u003C3.1.31","source":"GitHub","reportedAt":"2026-09-23 18:33:57","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-v3f3-cmj4-cvj9"}]},{"advisoryId":"PKSA-zdww-z1qy-tc3x","packageName":"verbb\/formie","remoteId":"GHSA-584p-f93j-wpgc","title":"Formie: Unauthenticated users can overwrite incomplete submissions via submit action","link":"https:\/\/github.com\/advisories\/GHSA-584p-f93j-wpgc","cve":"CVE-2026-76087","affectedVersions":"\u003C2.2.23|\u003E=3.0.0,\u003C3.1.31","source":"GitHub","reportedAt":"2026-09-23 18:36:44","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-584p-f93j-wpgc"}]}],"sulu\/sulu":[{"advisoryId":"PKSA-mg6n-7v6r-wbcq","packageName":"sulu\/sulu","remoteId":"GHSA-jg26-q8hg-3pq4","title":"Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)","link":"https:\/\/github.com\/advisories\/GHSA-jg26-q8hg-3pq4","cve":"CVE-2026-92692","affectedVersions":"\u003E=3.0.0,\u003C3.0.8|\u003C2.6.25","source":"GitHub","reportedAt":"2026-09-23 18:21:22","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-jg26-q8hg-3pq4"}]},{"advisoryId":"PKSA-nbbf-nf63-19vd","packageName":"sulu\/sulu","remoteId":"GHSA-pp4x-ccxq-6r33","title":"Sulu: Stored XSS via media download inline-disposition override","link":"https:\/\/github.com\/advisories\/GHSA-pp4x-ccxq-6r33","cve":"CVE-2026-82396","affectedVersions":"\u003E=3.0.0-alpha1,\u003C3.0.8|\u003C=2.6.24","source":"GitHub","reportedAt":"2026-09-02 15:10:19","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-pp4x-ccxq-6r33"}]},{"advisoryId":"PKSA-2gwf-7fts-yzvv","packageName":"sulu\/sulu","remoteId":"GHSA-65cv-w493-7vhq","title":"Sulu: Fix authorization bypass when creating preview links","link":"https:\/\/github.com\/advisories\/GHSA-65cv-w493-7vhq","cve":"CVE-2026-82394","affectedVersions":"\u003E=3.0.0-alpha1,\u003C3.0.8|\u003C=2.6.24","source":"GitHub","reportedAt":"2026-09-02 15:09:33","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-65cv-w493-7vhq"}]},{"advisoryId":"PKSA-zmfc-sgjt-9gmb","packageName":"sulu\/sulu","remoteId":"GHSA-h6cx-gjxx-v25c","title":"Sulu: Media move\/update authorization bypass (IDOR)","link":"https:\/\/github.com\/advisories\/GHSA-h6cx-gjxx-v25c","cve":"CVE-2026-82395","affectedVersions":"\u003E=3.0.0-alpha1,\u003C3.0.8|\u003C=2.6.24","source":"GitHub","reportedAt":"2026-09-02 14:57:25","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-h6cx-gjxx-v25c"}]}],"solspace\/craft-freeform":[{"advisoryId":"PKSA-x44x-t9qv-gv3x","packageName":"solspace\/craft-freeform","remoteId":"GHSA-gxrg-x694-283w","title":"Solspace Freeform: Limited Twig template injection via submitted field values","link":"https:\/\/github.com\/advisories\/GHSA-gxrg-x694-283w","cve":"CVE-2026-73858","affectedVersions":"\u003E=5.0.0,\u003C=5.10.13","source":"GitHub","reportedAt":"2026-09-23 14:31:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-gxrg-x694-283w"}]}],"wp-graphql\/wp-graphql":[{"advisoryId":"PKSA-8djr-jy87-r26y","packageName":"wp-graphql\/wp-graphql","remoteId":"GHSA-5mmc-8pc9-wggg","title":"WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost","link":"https:\/\/github.com\/advisories\/GHSA-5mmc-8pc9-wggg","cve":"CVE-2026-88974","affectedVersions":"\u003C2.22.2","source":"GitHub","reportedAt":"2026-09-23 14:13:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5mmc-8pc9-wggg"}]}],"paymenter\/paymenter":[{"advisoryId":"PKSA-6cm2-46tz-5tjg","packageName":"paymenter\/paymenter","remoteId":"GHSA-5gmm-hjfj-8ff7","title":"Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)","link":"https:\/\/github.com\/advisories\/GHSA-5gmm-hjfj-8ff7","cve":"CVE-2026-71537","affectedVersions":"\u003C=1.5.6","source":"GitHub","reportedAt":"2026-09-18 17:58:55","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5gmm-hjfj-8ff7"}]}],"mediawiki\/semantic-media-wiki":[{"advisoryId":"PKSA-stqx-crkb-215f","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-7xv3-gf2g-498h","title":"Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS","link":"https:\/\/github.com\/advisories\/GHSA-7xv3-gf2g-498h","cve":"CVE-2026-77607","affectedVersions":"\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:50:01","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7xv3-gf2g-498h"}]},{"advisoryId":"PKSA-k3v8-z9j2-2f38","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-hw3m-8j5x-94ff","title":"Semantic MediaWiki has an open redirect in Special:URIResolver","link":"https:\/\/github.com\/advisories\/GHSA-hw3m-8j5x-94ff","cve":"CVE-2026-77609","affectedVersions":"\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:51:25","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-hw3m-8j5x-94ff"}]},{"advisoryId":"PKSA-5kcn-7vbr-1pdw","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-q5fm-9mx6-44f4","title":"Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)","link":"https:\/\/github.com\/advisories\/GHSA-q5fm-9mx6-44f4","cve":"CVE-2026-77610","affectedVersions":"\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:53:23","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q5fm-9mx6-44f4"}]},{"advisoryId":"PKSA-yxd8-n1ty-bgkg","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-cx86-7xwp-w9wf","title":"Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token","link":"https:\/\/github.com\/advisories\/GHSA-cx86-7xwp-w9wf","cve":"CVE-2026-77616","affectedVersions":"\u003E=7.0.0,\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:58:50","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-cx86-7xwp-w9wf"}]},{"advisoryId":"PKSA-rt5h-3dwq-vdnx","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-9rcc-pmj8-ffhr","title":"Semantic MediaWiki\u0027s Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)","link":"https:\/\/github.com\/advisories\/GHSA-9rcc-pmj8-ffhr","cve":null,"affectedVersions":"\u003E=4.2.0,\u003C=7.2.0","source":"GitHub","reportedAt":"2026-09-18 16:59:16","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9rcc-pmj8-ffhr"}]},{"advisoryId":"PKSA-8k3f-637m-ptt7","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-jr78-w6w5-m8f8","title":"Semantic MediaWiki\u0027a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks","link":"https:\/\/github.com\/advisories\/GHSA-jr78-w6w5-m8f8","cve":null,"affectedVersions":"\u003E=3.0.0,\u003C=7.2.1","source":"GitHub","reportedAt":"2026-09-18 16:59:31","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-jr78-w6w5-m8f8"}]},{"advisoryId":"PKSA-6xyn-p8dg-1kgj","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-3jp5-3h47-28qf","title":"Semantic MediaWiki has reflected XSS in Special:Ask plain table headers","link":"https:\/\/github.com\/advisories\/GHSA-3jp5-3h47-28qf","cve":"CVE-2026-77606","affectedVersions":"\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:40:36","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-3jp5-3h47-28qf"}]},{"advisoryId":"PKSA-2trz-n7bz-xg2h","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-59xw-qv23-j3rc","title":"Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)","link":"https:\/\/github.com\/advisories\/GHSA-59xw-qv23-j3rc","cve":"CVE-2026-77608","affectedVersions":"\u003C=7.1.0","source":"GitHub","reportedAt":"2026-09-18 16:42:50","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-59xw-qv23-j3rc"}]},{"advisoryId":"PKSA-q8ty-xz99-jhhj","packageName":"mediawiki\/semantic-media-wiki","remoteId":"GHSA-hg8h-557g-q8pp","title":"Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes","link":"https:\/\/github.com\/advisories\/GHSA-hg8h-557g-q8pp","cve":"CVE-2025-61682","affectedVersions":"\u003E=3.1.0,\u003C7.0.0","source":"GitHub","reportedAt":"2026-09-18 16:07:29","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-hg8h-557g-q8pp"}]}],"getgrav\/grav":[{"advisoryId":"PKSA-nc3c-xf26-g5gp","packageName":"getgrav\/grav","remoteId":"GHSA-f8wv-xp27-6gq7","title":"Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write","link":"https:\/\/github.com\/advisories\/GHSA-f8wv-xp27-6gq7","cve":"CVE-2026-75827","affectedVersions":"\u003C=2.0.14","source":"GitHub","reportedAt":"2026-09-17 20:44:16","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-f8wv-xp27-6gq7"}]},{"advisoryId":"PKSA-ht1d-wm6t-8sdj","packageName":"getgrav\/grav","remoteId":"GHSA-q2j8-x8hf-63ch","title":"Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate","link":"https:\/\/github.com\/advisories\/GHSA-q2j8-x8hf-63ch","cve":"CVE-2026-75834","affectedVersions":"\u003C2.0.14","source":"GitHub","reportedAt":"2026-09-17 20:44:39","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q2j8-x8hf-63ch"}]},{"advisoryId":"PKSA-t3gq-ss3y-p7b7","packageName":"getgrav\/grav","remoteId":"GHSA-4v9q-p283-qc2m","title":"Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)","link":"https:\/\/github.com\/advisories\/GHSA-4v9q-p283-qc2m","cve":"CVE-2026-74907","affectedVersions":"\u003C=2.0.14","source":"GitHub","reportedAt":"2026-09-17 20:43:16","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-4v9q-p283-qc2m"}]},{"advisoryId":"PKSA-dzhx-7r7k-p6cx","packageName":"getgrav\/grav","remoteId":"GHSA-xhfv-7758-r9hx","title":"Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin","link":"https:\/\/github.com\/advisories\/GHSA-xhfv-7758-r9hx","cve":"CVE-2026-75837","affectedVersions":"\u003C2.0.14","source":"GitHub","reportedAt":"2026-09-17 20:45:15","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-xhfv-7758-r9hx"}]},{"advisoryId":"PKSA-tr1n-vmpf-rmt6","packageName":"getgrav\/grav","remoteId":"GHSA-vfmf-q6x9-cw96","title":"Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS","link":"https:\/\/github.com\/advisories\/GHSA-vfmf-q6x9-cw96","cve":"CVE-2026-75828","affectedVersions":"\u003C=2.0.14","source":"GitHub","reportedAt":"2026-09-17 20:43:43","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-vfmf-q6x9-cw96"}]},{"advisoryId":"PKSA-b2c2-gv41-gcc7","packageName":"getgrav\/grav","remoteId":"GHSA-r94f-hx44-8jqf","title":"Grav CMS vulnerable to remote code execution via .zip file upload","link":"https:\/\/github.com\/advisories\/GHSA-r94f-hx44-8jqf","cve":"CVE-2026-72819","affectedVersions":"\u003C2.0.13","source":"GitHub","reportedAt":"2026-09-17 20:45:57","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-r94f-hx44-8jqf"}]},{"advisoryId":"PKSA-275t-x9d8-k5s3","packageName":"getgrav\/grav","remoteId":"GHSA-jq29-c7v8-rg55","title":"Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion","link":"https:\/\/github.com\/advisories\/GHSA-jq29-c7v8-rg55","cve":"CVE-2026-72695","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:34:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-jq29-c7v8-rg55"}]},{"advisoryId":"PKSA-ms14-tz6x-6sqm","packageName":"getgrav\/grav","remoteId":"GHSA-9ccq-2jfg-qw33","title":"Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match","link":"https:\/\/github.com\/advisories\/GHSA-9ccq-2jfg-qw33","cve":"CVE-2026-72702","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:24:38","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-9ccq-2jfg-qw33"}]},{"advisoryId":"PKSA-xzd7-91fp-yh97","packageName":"getgrav\/grav","remoteId":"GHSA-38p6-h87p-r4cg","title":"Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection","link":"https:\/\/github.com\/advisories\/GHSA-38p6-h87p-r4cg","cve":"CVE-2026-72701","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:25:05","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-38p6-h87p-r4cg"}]},{"advisoryId":"PKSA-wz98-fgrh-3wq2","packageName":"getgrav\/grav","remoteId":"GHSA-p597-crqc-m349","title":"Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths","link":"https:\/\/github.com\/advisories\/GHSA-p597-crqc-m349","cve":"CVE-2026-72698","affectedVersions":"\u003C2.0.16","source":"GitHub","reportedAt":"2026-09-17 20:25:42","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p597-crqc-m349"}]},{"advisoryId":"PKSA-rk3g-1sfp-78gs","packageName":"getgrav\/grav","remoteId":"GHSA-xjw5-q542-3vmr","title":"Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled","link":"https:\/\/github.com\/advisories\/GHSA-xjw5-q542-3vmr","cve":"CVE-2026-76846","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:27:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-xjw5-q542-3vmr"}]},{"advisoryId":"PKSA-f7gk-wxm8-5j49","packageName":"getgrav\/grav","remoteId":"GHSA-3jhr-mxmx-38cx","title":"Grav: UserInterface offsetget\/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()","link":"https:\/\/github.com\/advisories\/GHSA-3jhr-mxmx-38cx","cve":"CVE-2026-76839","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:27:30","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3jhr-mxmx-38cx"}]},{"advisoryId":"PKSA-9871-4yy4-mgt8","packageName":"getgrav\/grav","remoteId":"GHSA-47ch-6w46-6xm7","title":"Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content","link":"https:\/\/github.com\/advisories\/GHSA-47ch-6w46-6xm7","cve":"CVE-2026-72697","affectedVersions":"\u003C=2.0.15","source":"GitHub","reportedAt":"2026-09-17 20:27:47","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-47ch-6w46-6xm7"}]},{"advisoryId":"PKSA-12j4-4z12-p48k","packageName":"getgrav\/grav","remoteId":"GHSA-6qw9-4vv5-jr97","title":"Grav: Stored XSS via Markdown audio\/video media \u003Csource\u003E URL","link":"https:\/\/github.com\/advisories\/GHSA-6qw9-4vv5-jr97","cve":"CVE-2026-75831","affectedVersions":"\u003C=2.0.14","source":"GitHub","reportedAt":"2026-09-17 17:31:41","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-6qw9-4vv5-jr97"}]},{"advisoryId":"PKSA-rstv-2c4g-sjjn","packageName":"getgrav\/grav","remoteId":"GHSA-269c-h76q-8cxw","title":"Grav: Stored XSS via quoted-attribute bypass in detectXss","link":"https:\/\/github.com\/advisories\/GHSA-269c-h76q-8cxw","cve":"CVE-2026-72832","affectedVersions":"\u003E=1.5.2,\u003C=2.0.12","source":"GitHub","reportedAt":"2026-09-17 17:28:34","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-269c-h76q-8cxw"}]},{"advisoryId":"PKSA-7hs4-c5nt-m1jh","packageName":"getgrav\/grav","remoteId":"GHSA-c4wf-2xxc-68qm","title":"Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation","link":"https:\/\/github.com\/advisories\/GHSA-c4wf-2xxc-68qm","cve":"CVE-2026-65608","affectedVersions":"\u003E=1.7.0,\u003C2.0.9","source":"GitHub","reportedAt":"2026-09-17 17:15:33","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-c4wf-2xxc-68qm"}]},{"advisoryId":"PKSA-pr7b-2t3z-v8y8","packageName":"getgrav\/grav","remoteId":"GHSA-7pgq-cr25-xvc8","title":"Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure","link":"https:\/\/github.com\/advisories\/GHSA-7pgq-cr25-xvc8","cve":"CVE-2026-69088","affectedVersions":"\u003E=2.0.7,\u003C=2.0.10","source":"GitHub","reportedAt":"2026-09-17 17:16:39","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-7pgq-cr25-xvc8"}]},{"advisoryId":"PKSA-89qq-5khy-n4c4","packageName":"getgrav\/grav","remoteId":"GHSA-w3f4-8pj2-599w","title":"Grav: Path Traversal in ImageMedium::watermark() \u2014 arbitrary file disclosure via publicly-cached images","link":"https:\/\/github.com\/advisories\/GHSA-w3f4-8pj2-599w","cve":"CVE-2026-69089","affectedVersions":"=2.0.10","source":"GitHub","reportedAt":"2026-09-17 17:16:56","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-w3f4-8pj2-599w"}]},{"advisoryId":"PKSA-wwkm-grbv-93ck","packageName":"getgrav\/grav","remoteId":"GHSA-37f3-6p89-6qr9","title":"Grav: Authenticated ReDoS via regex_replace in Twig Sandbox","link":"https:\/\/github.com\/advisories\/GHSA-37f3-6p89-6qr9","cve":"CVE-2026-62672","affectedVersions":"\u003C2.0.4","source":"GitHub","reportedAt":"2026-09-02 14:50:57","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-37f3-6p89-6qr9"}]},{"advisoryId":"PKSA-yvdd-fpv6-9ncp","packageName":"getgrav\/grav","remoteId":"GHSA-8h9x-89f2-m7x3","title":"Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver\/Installer","link":"https:\/\/github.com\/advisories\/GHSA-8h9x-89f2-m7x3","cve":"CVE-2026-61449","affectedVersions":"=2.0.1","source":"GitHub","reportedAt":"2026-09-17 14:53:33","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-8h9x-89f2-m7x3"}]},{"advisoryId":"PKSA-4j1y-b223-8d57","packageName":"getgrav\/grav","remoteId":"GHSA-2vcx-h8p2-9pg9","title":"Grav CMS \u2014 Improper Handling of Highly Compressed Data in Installer::unZip()","link":"https:\/\/github.com\/advisories\/GHSA-2vcx-h8p2-9pg9","cve":"CVE-2026-59193","affectedVersions":"\u003E=1.0.0,\u003C2.0.0","source":"GitHub","reportedAt":"2026-09-16 22:12:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-2vcx-h8p2-9pg9"}]},{"advisoryId":"PKSA-y2jw-px84-6zx6","packageName":"getgrav\/grav","remoteId":"GHSA-2c4f-86xc-cr74","title":"Grav: XSS Blueprint Validation Bypass via Twig String Concatenation","link":"https:\/\/github.com\/advisories\/GHSA-2c4f-86xc-cr74","cve":"CVE-2026-61453","affectedVersions":"=2.0.0","source":"GitHub","reportedAt":"2026-09-16 22:13:17","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-2c4f-86xc-cr74"}]},{"advisoryId":"PKSA-fkd8-syrt-878t","packageName":"getgrav\/grav","remoteId":"GHSA-ffmg-hfvg-jhg9","title":"Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav","link":"https:\/\/github.com\/advisories\/GHSA-ffmg-hfvg-jhg9","cve":"CVE-2026-58657","affectedVersions":"=2.0.0-rc.9","source":"GitHub","reportedAt":"2026-09-16 22:14:53","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-ffmg-hfvg-jhg9"}]},{"advisoryId":"PKSA-p6yn-thc9-dbs3","packageName":"getgrav\/grav","remoteId":"GHSA-7mgc-c7pq-3rr3","title":"Grav: 2FA Bypass via \u0027login.regenerate2FASecret\u0027 - Secret Rotation During Pending Challenge","link":"https:\/\/github.com\/advisories\/GHSA-7mgc-c7pq-3rr3","cve":"CVE-2026-62669","affectedVersions":"\u003C2.0.4","source":"GitHub","reportedAt":"2026-09-02 22:01:25","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-7mgc-c7pq-3rr3"}]},{"advisoryId":"PKSA-sq15-xbtt-m678","packageName":"getgrav\/grav","remoteId":"GHSA-mc5q-6hpj-rp7j","title":"Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)","link":"https:\/\/github.com\/advisories\/GHSA-mc5q-6hpj-rp7j","cve":"CVE-2026-61842","affectedVersions":"\u003C2.0.2","source":"GitHub","reportedAt":"2026-09-02 21:41:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mc5q-6hpj-rp7j"}]},{"advisoryId":"PKSA-2vrn-cxz9-yg23","packageName":"getgrav\/grav","remoteId":"GHSA-928x-9mpw-8h56","title":"Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits","link":"https:\/\/github.com\/advisories\/GHSA-928x-9mpw-8h56","cve":"CVE-2026-61690","affectedVersions":"\u003C2.0.1","source":"GitHub","reportedAt":"2026-09-02 21:35:43","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-928x-9mpw-8h56"}]},{"advisoryId":"PKSA-1q9r-bgms-91mf","packageName":"getgrav\/grav","remoteId":"GHSA-fj2p-qj2f-74v5","title":"Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()","link":"https:\/\/github.com\/advisories\/GHSA-fj2p-qj2f-74v5","cve":"CVE-2026-64850","affectedVersions":"\u003C2.0.7","source":"GitHub","reportedAt":"2026-09-02 14:51:18","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-fj2p-qj2f-74v5"}]},{"advisoryId":"PKSA-59xg-9744-g5wz","packageName":"getgrav\/grav","remoteId":"GHSA-3446-6mgw-f79p","title":"Grav is Vulnerable to XXE via SVG Upload ","link":"https:\/\/github.com\/advisories\/GHSA-3446-6mgw-f79p","cve":"CVE-2026-56701","affectedVersions":"\u003C2.0.0-beta.2","source":"GitHub","reportedAt":"2026-05-05 21:35:53","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-3446-6mgw-f79p"}]}],"chamilo\/chamilo-lms":[{"advisoryId":"PKSA-m8ms-hgzz-8ddw","packageName":"chamilo\/chamilo-lms","remoteId":"GHSA-g4c3-4g96-6g4m","title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-g4c3-4g96-6g4m","cve":"CVE-2026-45140","affectedVersions":"\u003C=2.0.0","source":"GitHub","reportedAt":"2026-09-17 20:23:39","composerRepository":null,"severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-g4c3-4g96-6g4m"}]}],"cakephp\/database":[{"advisoryId":"PKSA-ny8z-1rqf-8z42","packageName":"cakephp\/database","remoteId":"GHSA-vjqc-q4mp-2rvf","title":"CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection","link":"https:\/\/github.com\/advisories\/GHSA-vjqc-q4mp-2rvf","cve":"CVE-2026-79752","affectedVersions":"\u003E=3.0.0,\u003C4.5.12|\u003E=5.3.0,\u003C5.3.7|\u003E=5.2.0,\u003C5.2.14|\u003E=5.0.0,\u003C5.1.9|\u003E=4.6.0,\u003C4.6.5","source":"GitHub","reportedAt":"2026-09-17 20:28:14","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-vjqc-q4mp-2rvf"}]},{"advisoryId":"PKSA-xyyq-wf7k-89mv","packageName":"cakephp\/database","remoteId":"GHSA-fxf7-vhh8-7vpq","title":"CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver","link":"https:\/\/github.com\/advisories\/GHSA-fxf7-vhh8-7vpq","cve":"CVE-2026-77635","affectedVersions":"\u003E=5.1.0,\u003C5.1.10|\u003E=5.2.0,\u003C5.2.15|\u003E=5.3.0,\u003C5.3.7","source":"GitHub","reportedAt":"2026-09-08 20:56:41","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-fxf7-vhh8-7vpq"}]}],"cakephp\/cakephp":[{"advisoryId":"PKSA-vxgj-bmcq-9b6x","packageName":"cakephp\/cakephp","remoteId":"GHSA-vjqc-q4mp-2rvf","title":"CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection","link":"https:\/\/github.com\/advisories\/GHSA-vjqc-q4mp-2rvf","cve":"CVE-2026-79752","affectedVersions":"\u003E=5.3.0,\u003C5.3.7|\u003E=5.2.0,\u003C5.2.14|\u003E=5.0.0,\u003C5.1.9|\u003E=4.6.0,\u003C4.6.5|\u003C4.5.12","source":"GitHub","reportedAt":"2026-09-17 20:28:14","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-vjqc-q4mp-2rvf"}]},{"advisoryId":"PKSA-rdvp-7sns-1dvh","packageName":"cakephp\/cakephp","remoteId":"GHSA-2qh5-382h-3jpc","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","link":"https:\/\/github.com\/advisories\/GHSA-2qh5-382h-3jpc","cve":"CVE-2026-77634","affectedVersions":"\u003E=5.3.0,\u003C5.3.7|\u003E=5.2.0,\u003C5.2.14|\u003E=5.0.0,\u003C5.1.8|\u003E=4.6.0,\u003C4.6.5|\u003E=4.5.0,\u003C4.5.12","source":"GitHub","reportedAt":"2026-09-08 20:56:26","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-2qh5-382h-3jpc"}]},{"advisoryId":"PKSA-d2h7-11vv-v66p","packageName":"cakephp\/cakephp","remoteId":"GHSA-fxf7-vhh8-7vpq","title":"CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver","link":"https:\/\/github.com\/advisories\/GHSA-fxf7-vhh8-7vpq","cve":"CVE-2026-77635","affectedVersions":"\u003E=5.1.0,\u003C5.1.10|\u003E=5.2.0,\u003C5.2.15|\u003E=5.3.0,\u003C5.3.7","source":"GitHub","reportedAt":"2026-09-08 20:56:41","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-fxf7-vhh8-7vpq"}]}],"october\/october":[{"advisoryId":"PKSA-dqgv-qnp4-9j5k","packageName":"october\/october","remoteId":"GHSA-2xmm-m4wv-3fjh","title":"October CMS: Incomplete Scheme Validation in Image Resizer","link":"https:\/\/github.com\/advisories\/GHSA-2xmm-m4wv-3fjh","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.3.4","source":"GitHub","reportedAt":"2026-09-14 17:15:44","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-2xmm-m4wv-3fjh"}]}],"october\/system":[{"advisoryId":"PKSA-syjw-hb9p-2d5m","packageName":"october\/system","remoteId":"GHSA-2ff2-mx52-q8wp","title":"October CMS: PHP Object Injection via Backend Widget Session Storage","link":"https:\/\/github.com\/advisories\/GHSA-2ff2-mx52-q8wp","cve":"CVE-2026-49400","affectedVersions":"\u003E=4.0.0,\u003C4.2.23|\u003C3.7.17","source":"GitHub","reportedAt":"2026-09-14 17:08:06","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-2ff2-mx52-q8wp"}]},{"advisoryId":"PKSA-m19v-7rfv-5pmv","packageName":"october\/system","remoteId":"GHSA-xv9m-fm3w-8w5x","title":"October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls","link":"https:\/\/github.com\/advisories\/GHSA-xv9m-fm3w-8w5x","cve":"CVE-2026-46696","affectedVersions":"\u003E=4.0.0,\u003C4.2.23|\u003C3.7.17","source":"GitHub","reportedAt":"2026-09-14 16:02:35","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-xv9m-fm3w-8w5x"}]}],"shopper\/framework":[{"advisoryId":"PKSA-xbk1-5yr7-c54k","packageName":"shopper\/framework","remoteId":"GHSA-99h5-jhh7-v3r3","title":"Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)","link":"https:\/\/github.com\/advisories\/GHSA-99h5-jhh7-v3r3","cve":"CVE-2026-56830","affectedVersions":"\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 21:30:14","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-99h5-jhh7-v3r3"}]},{"advisoryId":"PKSA-b41c-cwpv-9733","packageName":"shopper\/framework","remoteId":"GHSA-2cg9-97gq-9mqp","title":"Shopper: Missing authorization on product removal actions in CollectionProducts component","link":"https:\/\/github.com\/advisories\/GHSA-2cg9-97gq-9mqp","cve":"CVE-2026-56825","affectedVersions":"\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 21:31:26","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-2cg9-97gq-9mqp"}]},{"advisoryId":"PKSA-j6gh-mr7c-jrwc","packageName":"shopper\/framework","remoteId":"GHSA-5vf4-452p-jjhf","title":"Shopper: Negative discount values accepted and propagated through order calculation pipeline","link":"https:\/\/github.com\/advisories\/GHSA-5vf4-452p-jjhf","cve":"CVE-2026-56831","affectedVersions":"\u003C2.9.0","source":"GitHub","reportedAt":"2026-09-11 21:28:00","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5vf4-452p-jjhf"}]},{"advisoryId":"PKSA-kzx5-8h8q-mx1w","packageName":"shopper\/framework","remoteId":"GHSA-f7h9-qv4x-9x57","title":"Shopping privilege escalation through missing authorization in Settings components","link":"https:\/\/github.com\/advisories\/GHSA-f7h9-qv4x-9x57","cve":"CVE-2026-56826","affectedVersions":"\u003E=2.0.0,\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 21:28:20","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-f7h9-qv4x-9x57"}]},{"advisoryId":"PKSA-5w3n-c3b1-mxqj","packageName":"shopper\/framework","remoteId":"GHSA-j328-xmgp-j4q3","title":"Shopper: privilege escalation via improper Livewire admin component authorization","link":"https:\/\/github.com\/advisories\/GHSA-j328-xmgp-j4q3","cve":"CVE-2026-56828","affectedVersions":"\u003E=2.8.0,\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 21:28:54","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-j328-xmgp-j4q3"}]},{"advisoryId":"PKSA-d6w1-f12g-cj15","packageName":"shopper\/framework","remoteId":"GHSA-g3f9-g5vj-p62f","title":"Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component","link":"https:\/\/github.com\/advisories\/GHSA-g3f9-g5vj-p62f","cve":"CVE-2026-56829","affectedVersions":"\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 21:29:20","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-g3f9-g5vj-p62f"}]},{"advisoryId":"PKSA-wj51-ggrn-qn6q","packageName":"shopper\/framework","remoteId":"GHSA-243p-f3cv-c5wh","title":"Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes\/tags and mass-toggle visibility of brands\/categories\/suppliers","link":"https:\/\/github.com\/advisories\/GHSA-243p-f3cv-c5wh","cve":"CVE-2026-56827","affectedVersions":"\u003C2.9.2","source":"GitHub","reportedAt":"2026-09-11 20:47:17","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-243p-f3cv-c5wh"}]}],"pimcore\/pimcore":[{"advisoryId":"PKSA-pmf2-z78s-582m","packageName":"pimcore\/pimcore","remoteId":"GHSA-23rh-xw42-fq82","title":"Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration","link":"https:\/\/github.com\/advisories\/GHSA-23rh-xw42-fq82","cve":"CVE-2026-55416","affectedVersions":"\u003C11.5.18|\u003E=12.0.0-RC1,\u003C=12.3.9|\u003E=2026.1.0,\u003C=2026.1.5","source":"GitHub","reportedAt":"2026-09-10 19:25:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-23rh-xw42-fq82"}]},{"advisoryId":"PKSA-6dhb-gq75-qpgr","packageName":"pimcore\/pimcore","remoteId":"GHSA-7p36-fq2r-4h7r","title":"Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed","link":"https:\/\/github.com\/advisories\/GHSA-7p36-fq2r-4h7r","cve":"CVE-2026-11407","affectedVersions":"\u003C=11.5.14.1|\u003E=12.0.0-RC1,\u003C=12.3.8","source":"GitHub","reportedAt":"2026-06-17 21:34:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-7p36-fq2r-4h7r"}]}],"predis\/predis":[{"advisoryId":"PKSA-z888-whwt-brbj","packageName":"predis\/predis","remoteId":"GHSA-w6f5-v2h6-g786","title":"Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections","link":"https:\/\/github.com\/advisories\/GHSA-w6f5-v2h6-g786","cve":"CVE-2026-84372","affectedVersions":"\u003E=3.0.0-RC1,\u003C3.3.0","source":"GitHub","reportedAt":"2026-09-08 20:57:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-w6f5-v2h6-g786"}]}],"maatwebsite\/excel":[{"advisoryId":"PKSA-xgss-dh88-nswy","packageName":"maatwebsite\/excel","remoteId":"GHSA-c7r6-vx3h-w5g2","title":"Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path","link":"https:\/\/github.com\/advisories\/GHSA-c7r6-vx3h-w5g2","cve":"CVE-2026-84374","affectedVersions":"\u003E=3.1.8,\u003C3.1.70","source":"GitHub","reportedAt":"2026-09-08 20:40:47","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-c7r6-vx3h-w5g2"}]}],"typo3\/cms-lowlevel":[{"advisoryId":"PKSA-t4m5-b2kz-hh4n","packageName":"typo3\/cms-lowlevel","remoteId":"typo3\/cms-lowlevel\/CVE-2026-85400.yaml","title":"TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-023","cve":"CVE-2026-85400","affectedVersions":"\u003E=14.2.0,\u003C14.3.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-08 09:01:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-lowlevel\/CVE-2026-85400.yaml"}]}],"typo3\/cms-backend":[{"advisoryId":"PKSA-745m-816f-bzfy","packageName":"typo3\/cms-backend","remoteId":"typo3\/cms-backend\/CVE-2026-77132.yaml","title":"TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-022","cve":"CVE-2026-77132","affectedVersions":"\u003E=10.0.0,\u003C10.4.60|\u003E=11.0.0,\u003C11.5.54|\u003E=12.0.0,\u003C12.4.49|\u003E=13.0.0,\u003C13.4.35|\u003E=14.0.0,\u003C14.3.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-08 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-backend\/CVE-2026-77132.yaml"}]},{"advisoryId":"PKSA-nmd9-kc7m-nsvr","packageName":"typo3\/cms-backend","remoteId":"GHSA-68jx-f42c-7599","title":"TYPO3 CMS - Broken Access Control in Backend and Install Tool","link":"https:\/\/github.com\/advisories\/GHSA-68jx-f42c-7599","cve":"CVE-2026-19418","affectedVersions":"\u003E=13.0.0,\u003C13.4.34","source":"GitHub","reportedAt":"2026-09-01 21:31:42","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-68jx-f42c-7599"}]}],"getkirby\/cms":[{"advisoryId":"PKSA-cmzk-n5t6-2v3k","packageName":"getkirby\/cms","remoteId":"GHSA-6j4c-mgqr-qv76","title":"Kirby: Access to image files outside of the site root via path traversal in the media handling","link":"https:\/\/github.com\/advisories\/GHSA-6j4c-mgqr-qv76","cve":"CVE-2026-75592","affectedVersions":"\u003E=5.0.0,\u003C5.5.2|\u003C4.9.5","source":"GitHub","reportedAt":"2026-09-02 14:55:22","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-6j4c-mgqr-qv76"}]},{"advisoryId":"PKSA-wq8z-fxnn-1fxz","packageName":"getkirby\/cms","remoteId":"GHSA-rf2p-vh74-7vvh","title":"Kirby: System path exposure from error messages in the REST API","link":"https:\/\/github.com\/advisories\/GHSA-rf2p-vh74-7vvh","cve":"CVE-2026-69127","affectedVersions":"\u003E=5.0.0,\u003C5.5.2|\u003C=4.9.4","source":"GitHub","reportedAt":"2026-09-01 16:37:47","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-rf2p-vh74-7vvh"}]},{"advisoryId":"PKSA-n74d-ghht-18nt","packageName":"getkirby\/cms","remoteId":"GHSA-9vx2-j98c-p72w","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","link":"https:\/\/github.com\/advisories\/GHSA-9vx2-j98c-p72w","cve":"CVE-2026-75594","affectedVersions":"\u003E=5.0.0,\u003C5.5.2|\u003C=4.9.4","source":"GitHub","reportedAt":"2026-08-31 22:12:45","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-9vx2-j98c-p72w"}]},{"advisoryId":"PKSA-cxg1-n9gs-z2t6","packageName":"getkirby\/cms","remoteId":"GHSA-67mx-6wf2-92xp","title":"Kirby: File upload permissions are not checked during processing of chunk data","link":"https:\/\/github.com\/advisories\/GHSA-67mx-6wf2-92xp","cve":"CVE-2026-71415","affectedVersions":"\u003E=5.0.0,\u003C5.5.2","source":"GitHub","reportedAt":"2026-08-31 22:14:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-67mx-6wf2-92xp"}]}],"apache\/thrift":[{"advisoryId":"PKSA-t5dt-c9kk-znks","packageName":"apache\/thrift","remoteId":"GHSA-8wv5-x4w7-5gww","title":"Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop","link":"https:\/\/github.com\/advisories\/GHSA-8wv5-x4w7-5gww","cve":"CVE-2026-43871","affectedVersions":"\u003C0.24.0","source":"GitHub","reportedAt":"2026-07-27 12:31:16","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-8wv5-x4w7-5gww"}]}],"studio-42\/elfinder":[{"advisoryId":"PKSA-th2b-2jzf-hmp6","packageName":"studio-42\/elfinder","remoteId":"GHSA-9hjf-w35w-6vx2","title":"elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections","link":"https:\/\/github.com\/advisories\/GHSA-9hjf-w35w-6vx2","cve":"CVE-2026-81890","affectedVersions":"\u003C2.1.70","source":"GitHub","reportedAt":"2026-09-02 14:37:36","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9hjf-w35w-6vx2"}]},{"advisoryId":"PKSA-71vn-d2sp-v1x4","packageName":"studio-42\/elfinder","remoteId":"GHSA-gxmj-r5rf-ggwq","title":"elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)","link":"https:\/\/github.com\/advisories\/GHSA-gxmj-r5rf-ggwq","cve":"CVE-2026-81891","affectedVersions":"\u003C2.1.70","source":"GitHub","reportedAt":"2026-09-02 14:37:54","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-gxmj-r5rf-ggwq"}]},{"advisoryId":"PKSA-r7xr-47v5-58tx","packageName":"studio-42\/elfinder","remoteId":"GHSA-8x3q-jpjh-qh5c","title":"elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback","link":"https:\/\/github.com\/advisories\/GHSA-8x3q-jpjh-qh5c","cve":"CVE-2026-81889","affectedVersions":"\u003C=2.1.69","source":"GitHub","reportedAt":"2026-08-31 20:28:06","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-8x3q-jpjh-qh5c"}]}],"livewire\/livewire":[{"advisoryId":"PKSA-bgw4-5zmg-2njg","packageName":"livewire\/livewire","remoteId":"GHSA-g3hc-697w-wm82","title":"Livewire DOM-based cross-site scripting during client-side state handling","link":"https:\/\/github.com\/advisories\/GHSA-g3hc-697w-wm82","cve":"CVE-2026-81887","affectedVersions":"\u003E=4.0.0-beta.1,\u003C=4.3.3|\u003E=3.0.0-beta.1,\u003C=3.8.2","source":"GitHub","reportedAt":"2026-09-02 14:38:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-g3hc-697w-wm82"}]}],"statamic\/cms":[{"advisoryId":"PKSA-rsd9-mj5m-pj4f","packageName":"statamic\/cms","remoteId":"GHSA-jppw-r5j3-xf7x","title":"Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering","link":"https:\/\/github.com\/advisories\/GHSA-jppw-r5j3-xf7x","cve":"CVE-2026-71293","affectedVersions":"\u003E=6.0.0-alpha.1,\u003C=6.30.0","source":"GitHub","reportedAt":"2026-08-05 15:32:21","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-jppw-r5j3-xf7x"}]}],"smarty\/smarty":[{"advisoryId":"PKSA-mz8k-7h5s-m8kh","packageName":"smarty\/smarty","remoteId":"GHSA-cq55-c7wv-pxmq","title":"Smarty: SSRF via redirect bypass of trusted_uri using {fetch}","link":"https:\/\/github.com\/advisories\/GHSA-cq55-c7wv-pxmq","cve":"CVE-2026-62993","affectedVersions":"\u003C4.5.7|\u003E=5.0.0,\u003C5.8.2","source":"GitHub","reportedAt":"2026-09-01 16:38:22","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-cq55-c7wv-pxmq"}]}],"apache-solr-for-typo3\/solr":[{"advisoryId":"PKSA-f58b-fgg4-r9xs","packageName":"apache-solr-for-typo3\/solr","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56093.yaml","title":"TYPO3-EXT-SA-2026-025: Broken Access Control in extension \u0022Apache Solr for TYPO3 - Enterprise Search\u0022 (solr)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-025","cve":"CVE-2026-56093","affectedVersions":"\u003E=13.0.0,\u003C13.1.4|\u003E=12.0.0,\u003C12.1.4|\u003C11.2.8|\u003E=11.5.0,\u003C11.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-25 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56093.yaml"}]},{"advisoryId":"PKSA-h6s2-79xk-1xwg","packageName":"apache-solr-for-typo3\/solr","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56092.yaml","title":"TYPO3-EXT-SA-2026-025: Broken Access Control in extension \u0022Apache Solr for TYPO3 - Enterprise Search\u0022 (solr)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-025","cve":"CVE-2026-56092","affectedVersions":"\u003E=13.0.0,\u003C13.1.4|\u003E=12.0.0,\u003C12.1.4|\u003C11.2.8|\u003E=11.5.0,\u003C11.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-25 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56092.yaml"}]},{"advisoryId":"PKSA-nmhg-n7vm-6z1n","packageName":"apache-solr-for-typo3\/solr","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56095.yaml","title":"TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension \u0022Apache Solr for TYPO3 - Enterprise Search\u0022 (solr)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-025","cve":"CVE-2026-56095","affectedVersions":"\u003E=13.0.0,\u003C13.1.4|\u003E=12.0.0,\u003C12.1.4|\u003E=11.5.0,\u003C11.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-25 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56095.yaml"}]},{"advisoryId":"PKSA-218x-ph2q-d2nf","packageName":"apache-solr-for-typo3\/solr","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56096.yaml","title":"TYPO3-EXT-SA-2026-025: Information Disclosure in extension \u0022Apache Solr for TYPO3 - Enterprise Search\u0022 (solr)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-025","cve":"CVE-2026-56096","affectedVersions":"\u003E=13.0.0,\u003C13.1.4|\u003E=12.0.0,\u003C12.1.4|\u003C11.2.8|\u003E=11.5.0,\u003C11.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-25 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56096.yaml"}]},{"advisoryId":"PKSA-xyyb-y2c3-k558","packageName":"apache-solr-for-typo3\/solr","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56094.yaml","title":"TYPO3-EXT-SA-2026-025: Information Disclosure in extension \u0022Apache Solr for TYPO3 - Enterprise Search\u0022 (solr)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-025","cve":"CVE-2026-56094","affectedVersions":"\u003E=13.0.0,\u003C13.1.4|\u003E=12.0.0,\u003C12.1.4|\u003C11.2.8|\u003E=11.5.0,\u003C11.6.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-25 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"apache-solr-for-typo3\/solr\/CVE-2026-56094.yaml"}]}],"typo3\/cms-core":[{"advisoryId":"PKSA-hf64-fs5s-6k3h","packageName":"typo3\/cms-core","remoteId":"typo3\/cms-core\/CVE-2026-19418.yaml","title":"TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-021","cve":"CVE-2026-19418","affectedVersions":"\u003E=13.0.0,\u003C13.4.34|\u003E=14.0.0,\u003C14.3.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-11 09:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-68jx-f42c-7599"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-core\/CVE-2026-19418.yaml"}]}],"easycorp\/easyadmin-bundle":[{"advisoryId":"PKSA-7ck7-y4vp-mmcz","packageName":"easycorp\/easyadmin-bundle","remoteId":"easycorp\/easyadmin-bundle\/CVE-2026-81892.yaml","title":"Custom action dispatcher bypasses access_control on other routes","link":"https:\/\/github.com\/EasyCorp\/EasyAdminBundle\/security\/advisories\/GHSA-g2fm-8hr4-j82h","cve":"CVE-2026-81892","affectedVersions":"\u003E=4.0.0,\u003C4.29.16|\u003E=5.0.0,\u003C5.5.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-11 06:38:40","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"easycorp\/easyadmin-bundle\/CVE-2026-81892.yaml"},{"name":"GitHub","remoteId":"GHSA-g2fm-8hr4-j82h"}]}],"phpcsstandards\/phpcsutils":[{"advisoryId":"PKSA-kh6k-gs3g-dgr6","packageName":"phpcsstandards\/phpcsutils","remoteId":"phpcsstandards\/phpcsutils\/CVE-2026-65954.yaml","title":"Arbitrary code execution","link":"https:\/\/github.com\/PHPCSStandards\/PHPCSUtils\/security\/advisories\/GHSA-r6hr-vr92-vv28","cve":"CVE-2026-65954","affectedVersions":"\u003E=1.0.0-alpha1,\u003C1.2.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-07-27 09:13:28","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-r6hr-vr92-vv28"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"phpcsstandards\/phpcsutils\/CVE-2026-65954.yaml"}]}],"craftcms\/cms":[{"advisoryId":"PKSA-gh5w-x99g-b53n","packageName":"craftcms\/cms","remoteId":"GHSA-xxpx-f366-4xpq","title":"Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures\/move-element","link":"https:\/\/github.com\/advisories\/GHSA-xxpx-f366-4xpq","cve":"CVE-2026-72785","affectedVersions":"\u003E=5.0.0-RC1,\u003C5.10.6","source":"GitHub","reportedAt":"2026-08-06 21:43:54","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-xxpx-f366-4xpq"}]},{"advisoryId":"PKSA-4q3g-gxhk-813s","packageName":"craftcms\/cms","remoteId":"GHSA-596p-6jv8-775v","title":"Craft CMS: Authenticated leak of secret environment variables","link":"https:\/\/github.com\/advisories\/GHSA-596p-6jv8-775v","cve":"CVE-2026-72782","affectedVersions":"\u003E=4.0.0-RC1,\u003C4.18.2|\u003E=5.0.0-RC1,\u003C5.10.6","source":"GitHub","reportedAt":"2026-08-06 21:53:31","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-596p-6jv8-775v"}]},{"advisoryId":"PKSA-19kf-75v5-vy76","packageName":"craftcms\/cms","remoteId":"GHSA-957r-qf9p-67xw","title":"Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts","link":"https:\/\/github.com\/advisories\/GHSA-957r-qf9p-67xw","cve":"CVE-2026-72779","affectedVersions":"\u003E=4.0.0-RC1,\u003C4.18.2|\u003E=5.0.0-RC1,\u003C5.10.6","source":"GitHub","reportedAt":"2026-08-06 21:54:45","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-957r-qf9p-67xw"}]},{"advisoryId":"PKSA-1412-5vdy-cd6w","packageName":"craftcms\/cms","remoteId":"GHSA-rvmm-v933-jgxq","title":"Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics","link":"https:\/\/github.com\/advisories\/GHSA-rvmm-v933-jgxq","cve":"CVE-2026-14794","affectedVersions":"\u003E=5.0.0-RC1,\u003C5.10.3|\u003E=4.0.0-RC1,\u003C4.18.1","source":"GitHub","reportedAt":"2026-08-06 21:42:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-rvmm-v933-jgxq"}]},{"advisoryId":"PKSA-82nd-44zr-vpmz","packageName":"craftcms\/cms","remoteId":"GHSA-7hxc-f267-h5q7","title":"Craft CMS: Incorrect path validation could potentially lead to path traversal","link":"https:\/\/github.com\/advisories\/GHSA-7hxc-f267-h5q7","cve":"CVE-2026-72783","affectedVersions":"\u003E=4.0.0-RC1,\u003C4.18.2|\u003E=5.0.0-RC1,\u003C5.10.6","source":"GitHub","reportedAt":"2026-08-06 21:36:11","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-7hxc-f267-h5q7"}]},{"advisoryId":"PKSA-d48x-nyby-nphv","packageName":"craftcms\/cms","remoteId":"GHSA-f5wm-88jv-g5hx","title":"Craft CMS: Authenticated RCE through Twig sandbox escape","link":"https:\/\/github.com\/advisories\/GHSA-f5wm-88jv-g5hx","cve":"CVE-2026-72781","affectedVersions":"\u003E=4.0.0-RC1,\u003C4.18.3|\u003E=5.0.0-RC1,\u003C5.10.7","source":"GitHub","reportedAt":"2026-08-06 21:02:28","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f5wm-88jv-g5hx"}]},{"advisoryId":"PKSA-4tjq-33kk-ghq8","packageName":"craftcms\/cms","remoteId":"GHSA-265m-7826-wjqm","title":"Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass","link":"https:\/\/github.com\/advisories\/GHSA-265m-7826-wjqm","cve":"CVE-2026-72778","affectedVersions":"\u003E=4.0.0-RC1,\u003C4.18.2|\u003E=5.0.0-RC1,\u003C5.10.6","source":"GitHub","reportedAt":"2026-08-06 20:45:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-265m-7826-wjqm"}]},{"advisoryId":"PKSA-24yr-dkzm-n9v5","packageName":"craftcms\/cms","remoteId":"GHSA-vg3j-hpm9-8v5v","title":"Craft CMS has a potential information disclosure vulnerability in preview tokens","link":"https:\/\/github.com\/advisories\/GHSA-vg3j-hpm9-8v5v","cve":"CVE-2026-29113","affectedVersions":"\u003E=5.0.0-RC1,\u003C5.9.7|\u003E=4.0.0-RC1,\u003C4.17.3","source":"GitHub","reportedAt":"2026-03-10 18:22:02","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-vg3j-hpm9-8v5v"}]}],"contao\/contao":[{"advisoryId":"PKSA-55tn-sgd6-9twh","packageName":"contao\/contao","remoteId":"contao\/contao\/CVE-2026-57232.yaml","title":"Server-side request forgery (SSRF) via unvalidated RSS feed URLs","link":"https:\/\/contao.org\/en\/security-advisories\/server-side-request-forgery-via-unvalidated-rss-feed-urls","cve":"CVE-2026-57232","affectedVersions":"\u003E=5.3.35,\u003C5.3.48|\u003E=5.4.0,\u003C5.7.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-07-13 09:10:22","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"contao\/contao\/CVE-2026-57232.yaml"},{"name":"GitHub","remoteId":"GHSA-87mg-5grr-rhwh"}]}],"wwbn\/avideo":[{"advisoryId":"PKSA-mhr2-p9hx-xy4j","packageName":"wwbn\/avideo","remoteId":"GHSA-wprj-9cvc-5w37","title":"AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records","link":"https:\/\/github.com\/advisories\/GHSA-wprj-9cvc-5w37","cve":"CVE-2026-56341","affectedVersions":"\u003C=26.0","source":"GitHub","reportedAt":"2026-03-29 15:40:52","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-wprj-9cvc-5w37"}]},{"advisoryId":"PKSA-3whn-q4tm-bwhh","packageName":"wwbn\/avideo","remoteId":"GHSA-5x2w-37xf-7962","title":"AVideo has Unauthenticated PGP Message Decryption via Public Endpoint","link":"https:\/\/github.com\/advisories\/GHSA-5x2w-37xf-7962","cve":"CVE-2026-56346","affectedVersions":"\u003C=25.0","source":"GitHub","reportedAt":"2026-03-19 12:46:01","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5x2w-37xf-7962"}]},{"advisoryId":"PKSA-mpqq-rw7h-r6qr","packageName":"wwbn\/avideo","remoteId":"GHSA-h39h-7cvg-q7j6","title":"AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php","link":"https:\/\/github.com\/advisories\/GHSA-h39h-7cvg-q7j6","cve":"CVE-2026-27732","affectedVersions":"\u003C=21.0","source":"GitHub","reportedAt":"2026-02-25 18:57:05","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-h39h-7cvg-q7j6"}]}],"web-tp3\/wec_map":[{"advisoryId":"PKSA-yvwr-r5t5-t6jk","packageName":"web-tp3\/wec_map","remoteId":"GHSA-mqhg-c7w9-w3cv","title":"WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting","link":"https:\/\/github.com\/advisories\/GHSA-mqhg-c7w9-w3cv","cve":"CVE-2014-6296","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-mqhg-c7w9-w3cv"}]},{"advisoryId":"PKSA-cj68-qpv3-85sd","packageName":"web-tp3\/wec_map","remoteId":"GHSA-f3v6-g4mv-pjhq","title":"WEC Map (wec_map) extension for TYPO3 allows SQL Injection","link":"https:\/\/github.com\/advisories\/GHSA-f3v6-g4mv-pjhq","cve":"CVE-2014-6295","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f3v6-g4mv-pjhq"}]}]}}