{"advisories":{"contao\/comments-bundle":[{"advisoryId":"PKSA-c42s-m9fj-8jxw","packageName":"contao\/comments-bundle","remoteId":"GHSA-628f-v4f6-p37r","title":"Contao: Cross-site scripting in the comments bundle","link":"https:\/\/github.com\/advisories\/GHSA-628f-v4f6-p37r","cve":"CVE-2026-107845","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-628f-v4f6-p37r"}]}],"contao\/core-bundle":[{"advisoryId":"PKSA-b5qj-hq3z-3ry8","packageName":"contao\/core-bundle","remoteId":"GHSA-5974-gfqc-wrcm","title":"Contao: Improper access control in the table access voter","link":"https:\/\/github.com\/advisories\/GHSA-5974-gfqc-wrcm","cve":"CVE-2026-107851","affectedVersions":"\u003E=5.7.0,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:42","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5974-gfqc-wrcm"}]},{"advisoryId":"PKSA-7n2q-445d-xssj","packageName":"contao\/core-bundle","remoteId":"GHSA-q6wp-fr43-gm9v","title":"Contao: Improper access control in the preview links module","link":"https:\/\/github.com\/advisories\/GHSA-q6wp-fr43-gm9v","cve":"CVE-2026-107850","affectedVersions":"\u003E=5.7.1,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:46","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q6wp-fr43-gm9v"}]},{"advisoryId":"PKSA-6j5h-bxmj-94h9","packageName":"contao\/core-bundle","remoteId":"GHSA-mrvp-7wmx-5m4h","title":"Contao: Path traversal in the images controller","link":"https:\/\/github.com\/advisories\/GHSA-mrvp-7wmx-5m4h","cve":"CVE-2026-107844","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:55","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mrvp-7wmx-5m4h"}]},{"advisoryId":"PKSA-6ymc-kdpm-qx87","packageName":"contao\/core-bundle","remoteId":"GHSA-9ff2-p842-45wq","title":"Contao: Cross-site request forgery in custom backend actions","link":"https:\/\/github.com\/advisories\/GHSA-9ff2-p842-45wq","cve":"CVE-2026-107848","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-9ff2-p842-45wq"}]},{"advisoryId":"PKSA-s71c-hg32-kv3f","packageName":"contao\/core-bundle","remoteId":"GHSA-mfxh-vp55-7gc6","title":"Contao: The registration module re-sends activation mails","link":"https:\/\/github.com\/advisories\/GHSA-mfxh-vp55-7gc6","cve":"CVE-2026-107843","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mfxh-vp55-7gc6"}]},{"advisoryId":"PKSA-bmqh-y7sv-p1st","packageName":"contao\/core-bundle","remoteId":"GHSA-x2rp-9qf7-2fmq","title":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled","link":"https:\/\/github.com\/advisories\/GHSA-x2rp-9qf7-2fmq","cve":"CVE-2026-107842","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:09","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x2rp-9qf7-2fmq"}]}],"enshrined\/svg-sanitize":[{"advisoryId":"PKSA-cbx2-m9db-bmzd","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-v383-3rw5-q8rf","title":"enshrined\/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","link":"https:\/\/github.com\/advisories\/GHSA-v383-3rw5-q8rf","cve":"CVE-2026-107379","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:05","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-v383-3rw5-q8rf"}]},{"advisoryId":"PKSA-6j95-1jtb-x6wc","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-m9xh-6747-9r6f","title":"svg-sanitizer: Mixed-case xlink:HrEf skips the `\u003Cuse\u003E` nesting-DoS check in Resolver::processReferences","link":"https:\/\/github.com\/advisories\/GHSA-m9xh-6747-9r6f","cve":"CVE-2026-107381","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-m9xh-6747-9r6f"}]},{"advisoryId":"PKSA-8j6w-3kr7-s9xk","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-9rjx-3jch-6vjf","title":"enshrined\/svg-sanitize: Stored XSS via DTD Entity \/ HTML5 Named Character Reference Collision","link":"https:\/\/github.com\/advisories\/GHSA-9rjx-3jch-6vjf","cve":"CVE-2026-107380","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:15","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9rjx-3jch-6vjf"}]}],"kunstmaan\/media-bundle":[{"advisoryId":"PKSA-qzt5-rxz6-8qm6","packageName":"kunstmaan\/media-bundle","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"kunstmaan\/bundles-cms":[{"advisoryId":"PKSA-c8mp-7f4z-q7q5","packageName":"kunstmaan\/bundles-cms","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"ueberdosis\/tiptap-php":[{"advisoryId":"PKSA-52qp-479k-9x2j","packageName":"ueberdosis\/tiptap-php","remoteId":"GHSA-4595-7fjw-r3jh","title":"Tiptap contains an input validation vulnerability resulting in DoS","link":"https:\/\/github.com\/advisories\/GHSA-4595-7fjw-r3jh","cve":"CVE-2026-47110","affectedVersions":"\u003C2.1.1","source":"GitHub","reportedAt":"2026-06-25 00:33:22","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-4595-7fjw-r3jh"}]}],"filament\/filament":[{"advisoryId":"PKSA-cnr1-6g7k-bp3d","packageName":"filament\/filament","remoteId":"GHSA-7m6h-rg42-m449","title":"Filament: Multi-factor authentication (app) management actions do not require password reauthentication","link":"https:\/\/github.com\/advisories\/GHSA-7m6h-rg42-m449","cve":"CVE-2026-104181","affectedVersions":"\u003E=5.0.0,\u003C5.8.2|\u003E=4.0.0,\u003C4.13.2","source":"GitHub","reportedAt":"2026-10-05 23:44:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7m6h-rg42-m449"}]}],"mongodb\/mongodb":[{"advisoryId":"PKSA-y93m-jgy6-r9ns","packageName":"mongodb\/mongodb","remoteId":"GHSA-8fxw-fmj8-xp7j","title":"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs","link":"https:\/\/github.com\/advisories\/GHSA-8fxw-fmj8-xp7j","cve":"CVE-2026-88023","affectedVersions":"\u003E=2.0.0,\u003C2.4.2|\u003E=1.1.0,\u003C1.21.5","source":"GitHub","reportedAt":"2026-10-05 23:26:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-8fxw-fmj8-xp7j"}]}],"composer\/composer":[{"advisoryId":"PKSA-ddsx-fjz2-sbs3","packageName":"composer\/composer","remoteId":"GHSA-96h3-5x6v-m776","title":"Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path","link":"https:\/\/github.com\/advisories\/GHSA-96h3-5x6v-m776","cve":"CVE-2026-59944","affectedVersions":"\u003E=1.0,\u003C2.2.30|\u003E=2.3.0,\u003C2.10.3","source":"GitHub","reportedAt":"2026-10-02 19:14:34","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-96h3-5x6v-m776"}]}],"league\/commonmark":[{"advisoryId":"PKSA-m4t9-vsgq-8khn","packageName":"league\/commonmark","remoteId":"GHSA-3q6v-r5mr-hxv8","title":"league\/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan","link":"https:\/\/github.com\/advisories\/GHSA-3q6v-r5mr-hxv8","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:13","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3q6v-r5mr-hxv8"}]},{"advisoryId":"PKSA-m2dq-1fhr-29b1","packageName":"league\/commonmark","remoteId":"GHSA-97jj-33gv-5xf9","title":"league\/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal","link":"https:\/\/github.com\/advisories\/GHSA-97jj-33gv-5xf9","cve":null,"affectedVersions":"\u003E=1.3.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:33","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-97jj-33gv-5xf9"}]}],"jayanta\/laravel-threat-detection":[{"advisoryId":"PKSA-fq5s-jjn9-17wq","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml","title":"Credentials under prefixed or nested names stored in cleartext in the threat log","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-6gg9-q48h-56vx","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml"}]},{"advisoryId":"PKSA-1nr4-5xd6-jgjp","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml","title":"Plaintext credentials written to the threat log and readable by any authenticated user","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-9jh8-pj82-6ccg","cve":null,"affectedVersions":"\u003C1.8.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-06 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml"}]},{"advisoryId":"PKSA-j8sb-5q45-xtvw","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml","title":"Attacks go unrecorded when a request carries malformed headers or oversized fields","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-3c4c-m8xj-3vc8","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml"}]},{"advisoryId":"PKSA-grsv-gc9r-djpk","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml","title":"Marking a detection as a false positive could create a wider exclusion rule than intended","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-rppj-hxxm-v5pr","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml"}]}],"phpseclib\/phpseclib":[{"advisoryId":"PKSA-12sz-bcny-pk4m","packageName":"phpseclib\/phpseclib","remoteId":"GHSA-q97c-8qh3-fpc6","title":"phpseclib \u2014 non-constant-time X25519 scalar multiplication permits full private-key recovery","link":"https:\/\/github.com\/advisories\/GHSA-q97c-8qh3-fpc6","cve":"CVE-2026-84308","affectedVersions":"\u003E=4.0.0,\u003C4.0.1|\u003C3.0.57","source":"GitHub","reportedAt":"2026-09-08 21:24:29","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q97c-8qh3-fpc6"}]}],"laravel\/framework":[{"advisoryId":"PKSA-d5tc-s1qs-h781","packageName":"laravel\/framework","remoteId":"GHSA-jh5r-qr3c-85q8","title":"Laravel: XSS in Debug Page Information","link":"https:\/\/github.com\/advisories\/GHSA-jh5r-qr3c-85q8","cve":"CVE-2026-102279","affectedVersions":"\u003E=13.0.0,\u003C13.30.0|\u003C12.69.0","source":"GitHub","reportedAt":"2026-09-29 18:24:25","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-jh5r-qr3c-85q8"}]}],"league\/flysystem":[{"advisoryId":"PKSA-w9tt-7782-78jx","packageName":"league\/flysystem","remoteId":"GHSA-cxf4-7mrp-vvpr","title":"Flysystem: WhitespacePathNormalizer\u0027s control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter","link":"https:\/\/github.com\/advisories\/GHSA-cxf4-7mrp-vvpr","cve":"CVE-2026-102601","affectedVersions":"\u003C=3.35.2","source":"GitHub","reportedAt":"2026-09-29 18:10:14","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-cxf4-7mrp-vvpr"}]}],"phpcsstandards\/phpcsutils":[{"advisoryId":"PKSA-kh6k-gs3g-dgr6","packageName":"phpcsstandards\/phpcsutils","remoteId":"phpcsstandards\/phpcsutils\/CVE-2026-65954.yaml","title":"Arbitrary code execution","link":"https:\/\/github.com\/PHPCSStandards\/PHPCSUtils\/security\/advisories\/GHSA-r6hr-vr92-vv28","cve":"CVE-2026-65954","affectedVersions":"\u003E=1.0.0-alpha1,\u003C1.2.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-07-27 09:13:28","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-r6hr-vr92-vv28"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"phpcsstandards\/phpcsutils\/CVE-2026-65954.yaml"}]}]}}