{"advisories":{"cachethq\/cachet":[{"advisoryId":"PKSA-b73h-txx9-5t8m","packageName":"cachethq\/cachet","remoteId":"GHSA-x397-5hrv-j9m9","title":"Cachet has Stored XSS in Incident Component","link":"https:\/\/github.com\/advisories\/GHSA-x397-5hrv-j9m9","cve":"CVE-2026-113712","affectedVersions":"\u003C=2.4.1","source":"GitHub","reportedAt":"2026-10-20 21:09:40","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x397-5hrv-j9m9"}]}],"kitodo\/presentation":[{"advisoryId":"PKSA-ggns-sv2d-stv8","packageName":"kitodo\/presentation","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml","title":"TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension \u0022Kitodo.Presentation\u0022 (dlf)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-032","cve":"CVE-2026-112237","affectedVersions":"\u003E=7.0.0,\u003C7.0.2|\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml"}]}],"blueways\/bw-captcha":[{"advisoryId":"PKSA-rwzb-f3sr-qs44","packageName":"blueways\/bw-captcha","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml","title":"TYPO3-EXT-SA-2026-030: Captcha Bypass in extension \u0022Accessible Form Captcha\u0022 (bw_captcha)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-030","cve":"CVE-2026-112067","affectedVersions":"\u003E=4.0.0,\u003C5.4.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml"}]}],"causal\/fal-protect":[{"advisoryId":"PKSA-6z5d-zh8g-4pfj","packageName":"causal\/fal-protect","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml","title":"TYPO3-EXT-SA-2026-028: Broken Access Control in extension \u0022FAL Protect\u0022 (fal_protect)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-028","cve":"CVE-2026-112069","affectedVersions":"\u003E=1.7.1,\u003C1.8.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml"}]}],"sgalinski\/sg-cookie-optin":[{"advisoryId":"PKSA-s32p-q272-ns98","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml","title":"TYPO3-EXT-SA-2026-029: SQL Injection in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112064","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml"}]},{"advisoryId":"PKSA-xc65-qxpn-2x5q","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112065","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml"}]},{"advisoryId":"PKSA-1t7r-3wn1-dsjs","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112066","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml"}]}],"t3g\/analytics":[{"advisoryId":"PKSA-x737-v31s-48yt","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml","title":"TYPO3-EXT-SA-2026-031: Broken Access Control in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112070","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml"}]},{"advisoryId":"PKSA-f25v-jzn7-jv3q","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml","title":"TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112068","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml"}]}],"nitsan\/ns-t3ai":[{"advisoryId":"PKSA-bvhd-xth6-k5xw","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml","title":"TYPO3-EXT-SA-2026-035: Broken Access Control in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-112239","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml"}]},{"advisoryId":"PKSA-kk39-vqqg-74n6","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml","title":"TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-113459","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml"}]}],"ameos\/ameos_filemanager":[{"advisoryId":"PKSA-jx7x-rkr7-n2tb","packageName":"ameos\/ameos_filemanager","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml","title":"TYPO3-EXT-SA-2026-034: SQL Injection in extension \u0022File manager\u0022 (ameos_filemanager)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-034","cve":"CVE-2026-112238","affectedVersions":"\u003C3.1.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml"}]}],"codingms\/shop":[{"advisoryId":"PKSA-qcjp-qhjx-bgmg","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-113468.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-113468","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-113468.yaml"}]},{"advisoryId":"PKSA-8c1z-qtpy-x6zn","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-112071.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-112071","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-112071.yaml"}]}],"codingms\/fluid-form":[{"advisoryId":"PKSA-s8v1-krjv-23c8","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml","title":"TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-113442","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml"}]},{"advisoryId":"PKSA-13xq-tz75-c2tq","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml","title":"TYPO3-EXT-SA-2026-033: Broken Access Control in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-112240","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml"}]}],"litesaml\/lightsaml":[{"advisoryId":"PKSA-n3jt-6ytb-s57s","packageName":"litesaml\/lightsaml","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml","title":"Signature validation bypass","link":"https:\/\/github.com\/litesaml\/lightsaml\/security\/advisories\/GHSA-rm7m-7jq4-gw46","cve":null,"affectedVersions":"\u003E=6.0.0,\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-16 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml"}]}],"yourls\/yourls":[{"advisoryId":"PKSA-grvh-n5s5-5dmb","packageName":"yourls\/yourls","remoteId":"GHSA-f8ff-652m-j5rx","title":"YOURLS: Unauthenticated File Inclusion","link":"https:\/\/github.com\/advisories\/GHSA-f8ff-652m-j5rx","cve":"CVE-2026-62858","affectedVersions":"\u003C=1.10.4","source":"GitHub","reportedAt":"2026-10-15 20:13:02","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-f8ff-652m-j5rx"}]}],"leantime\/leantime":[{"advisoryId":"PKSA-vxb4-5j8y-5cbx","packageName":"leantime\/leantime","remoteId":"GHSA-54mm-6729-r5wp","title":"Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods","link":"https:\/\/github.com\/advisories\/GHSA-54mm-6729-r5wp","cve":"CVE-2026-85990","affectedVersions":"\u003C3.10.0","source":"GitHub","reportedAt":"2026-10-15 20:14:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-54mm-6729-r5wp"}]}],"react\/http":[{"advisoryId":"PKSA-y8pw-63n4-d3gg","packageName":"react\/http","remoteId":"GHSA-g4f2-2pf3-2pwj","title":"react\/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","link":"https:\/\/github.com\/advisories\/GHSA-g4f2-2pf3-2pwj","cve":"CVE-2026-104827","affectedVersions":"\u003E=1.0.0,\u003C=1.11.0","source":"GitHub","reportedAt":"2026-10-15 20:09:56","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-g4f2-2pf3-2pwj"}]}],"symfony\/http-foundation":[{"advisoryId":"PKSA-xmwy-rmx5-m7h4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml"}]}],"symfony\/symfony":[{"advisoryId":"PKSA-fyjn-dgwp-4tt3","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml"}]},{"advisoryId":"PKSA-zxg3-vspd-sr38","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml"}]},{"advisoryId":"PKSA-5gdh-tt4n-ckh2","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml"}]}],"symfony\/yaml":[{"advisoryId":"PKSA-xz3r-9gp4-4m1z","packageName":"symfony\/yaml","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml"}]}],"symfony\/expression-language":[{"advisoryId":"PKSA-vq1j-sc3k-jzzk","packageName":"symfony\/expression-language","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml"}]}],"aptoma\/twig-markdown":[{"advisoryId":"PKSA-pth7-jz73-t51g","packageName":"aptoma\/twig-markdown","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-APTOMATWIGMARKDOWN-8400480","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.4.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-10-31 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml"}]}],"pattern-lab\/drupal-twig-components":[{"advisoryId":"PKSA-xhgb-v99m-4h6n","packageName":"pattern-lab\/drupal-twig-components","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-PATTERNLABDRUPALTWIGCOMPONENTS-8400872","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=2.2.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml"}]}],"j0k3r\/httplug-ssrf-plugin":[{"advisoryId":"PKSA-px1b-j2dd-31r6","packageName":"j0k3r\/httplug-ssrf-plugin","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml","title":"Server-side Request Forgery (SSRF)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-J0K3RHTTPLUGSSRFPLUGIN-8400871","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/add-attributes-twig-extension":[{"advisoryId":"PKSA-wczj-fvbh-sqgr","packageName":"drupal-pattern-lab\/add-attributes-twig-extension","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABADDATTRIBUTESTWIGEXTENSION-8400879","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/bem-twig-extension":[{"advisoryId":"PKSA-9j51-377g-2f4j","packageName":"drupal-pattern-lab\/bem-twig-extension","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABBEMTWIGEXTENSION-8400878","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/unified-twig-extensions":[{"advisoryId":"PKSA-13v9-rks1-fwdd","packageName":"drupal-pattern-lab\/unified-twig-extensions","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=0.1.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml"}]}],"typo3\/cms-form":[{"advisoryId":"PKSA-fykt-pmbg-txnv","packageName":"typo3\/cms-form","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml","title":"TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-024","cve":"CVE-2026-109162","affectedVersions":"\u003E=14.0.0,\u003C14.3.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-13 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml"}]}],"contao\/comments-bundle":[{"advisoryId":"PKSA-c42s-m9fj-8jxw","packageName":"contao\/comments-bundle","remoteId":"GHSA-628f-v4f6-p37r","title":"Contao: Cross-site scripting in the comments bundle","link":"https:\/\/github.com\/advisories\/GHSA-628f-v4f6-p37r","cve":"CVE-2026-107845","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-628f-v4f6-p37r"}]}],"contao\/core-bundle":[{"advisoryId":"PKSA-b5qj-hq3z-3ry8","packageName":"contao\/core-bundle","remoteId":"GHSA-5974-gfqc-wrcm","title":"Contao: Improper access control in the table access voter","link":"https:\/\/github.com\/advisories\/GHSA-5974-gfqc-wrcm","cve":"CVE-2026-107851","affectedVersions":"\u003E=5.7.0,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:42","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5974-gfqc-wrcm"}]},{"advisoryId":"PKSA-7n2q-445d-xssj","packageName":"contao\/core-bundle","remoteId":"GHSA-q6wp-fr43-gm9v","title":"Contao: Improper access control in the preview links module","link":"https:\/\/github.com\/advisories\/GHSA-q6wp-fr43-gm9v","cve":"CVE-2026-107850","affectedVersions":"\u003E=5.7.1,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:46","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q6wp-fr43-gm9v"}]},{"advisoryId":"PKSA-6j5h-bxmj-94h9","packageName":"contao\/core-bundle","remoteId":"GHSA-mrvp-7wmx-5m4h","title":"Contao: Path traversal in the images controller","link":"https:\/\/github.com\/advisories\/GHSA-mrvp-7wmx-5m4h","cve":"CVE-2026-107844","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:55","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mrvp-7wmx-5m4h"}]},{"advisoryId":"PKSA-6ymc-kdpm-qx87","packageName":"contao\/core-bundle","remoteId":"GHSA-9ff2-p842-45wq","title":"Contao: Cross-site request forgery in custom backend actions","link":"https:\/\/github.com\/advisories\/GHSA-9ff2-p842-45wq","cve":"CVE-2026-107848","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-9ff2-p842-45wq"}]},{"advisoryId":"PKSA-s71c-hg32-kv3f","packageName":"contao\/core-bundle","remoteId":"GHSA-mfxh-vp55-7gc6","title":"Contao: The registration module re-sends activation mails","link":"https:\/\/github.com\/advisories\/GHSA-mfxh-vp55-7gc6","cve":"CVE-2026-107843","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mfxh-vp55-7gc6"}]},{"advisoryId":"PKSA-bmqh-y7sv-p1st","packageName":"contao\/core-bundle","remoteId":"GHSA-x2rp-9qf7-2fmq","title":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled","link":"https:\/\/github.com\/advisories\/GHSA-x2rp-9qf7-2fmq","cve":"CVE-2026-107842","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:09","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x2rp-9qf7-2fmq"}]}],"enshrined\/svg-sanitize":[{"advisoryId":"PKSA-cbx2-m9db-bmzd","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-v383-3rw5-q8rf","title":"enshrined\/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","link":"https:\/\/github.com\/advisories\/GHSA-v383-3rw5-q8rf","cve":"CVE-2026-107379","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:05","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-v383-3rw5-q8rf"}]},{"advisoryId":"PKSA-6j95-1jtb-x6wc","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-m9xh-6747-9r6f","title":"svg-sanitizer: Mixed-case xlink:HrEf skips the `\u003Cuse\u003E` nesting-DoS check in Resolver::processReferences","link":"https:\/\/github.com\/advisories\/GHSA-m9xh-6747-9r6f","cve":"CVE-2026-107381","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-m9xh-6747-9r6f"}]},{"advisoryId":"PKSA-8j6w-3kr7-s9xk","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-9rjx-3jch-6vjf","title":"enshrined\/svg-sanitize: Stored XSS via DTD Entity \/ HTML5 Named Character Reference Collision","link":"https:\/\/github.com\/advisories\/GHSA-9rjx-3jch-6vjf","cve":"CVE-2026-107380","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:15","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9rjx-3jch-6vjf"}]}],"kunstmaan\/media-bundle":[{"advisoryId":"PKSA-qzt5-rxz6-8qm6","packageName":"kunstmaan\/media-bundle","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"kunstmaan\/bundles-cms":[{"advisoryId":"PKSA-c8mp-7f4z-q7q5","packageName":"kunstmaan\/bundles-cms","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"ueberdosis\/tiptap-php":[{"advisoryId":"PKSA-52qp-479k-9x2j","packageName":"ueberdosis\/tiptap-php","remoteId":"GHSA-4595-7fjw-r3jh","title":"Tiptap contains an input validation vulnerability resulting in DoS","link":"https:\/\/github.com\/advisories\/GHSA-4595-7fjw-r3jh","cve":"CVE-2026-47110","affectedVersions":"\u003C2.1.1","source":"GitHub","reportedAt":"2026-06-25 00:33:22","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-4595-7fjw-r3jh"}]}],"filament\/filament":[{"advisoryId":"PKSA-cnr1-6g7k-bp3d","packageName":"filament\/filament","remoteId":"GHSA-7m6h-rg42-m449","title":"Filament: Multi-factor authentication (app) management actions do not require password reauthentication","link":"https:\/\/github.com\/advisories\/GHSA-7m6h-rg42-m449","cve":"CVE-2026-104181","affectedVersions":"\u003E=5.0.0,\u003C=5.8.2|\u003E=4.0.0,\u003C=4.13.2","source":"GitHub","reportedAt":"2026-10-05 23:44:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7m6h-rg42-m449"}]}],"mongodb\/mongodb":[{"advisoryId":"PKSA-y93m-jgy6-r9ns","packageName":"mongodb\/mongodb","remoteId":"GHSA-8fxw-fmj8-xp7j","title":"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs","link":"https:\/\/github.com\/advisories\/GHSA-8fxw-fmj8-xp7j","cve":"CVE-2026-88023","affectedVersions":"\u003E=2.0.0,\u003C2.4.2|\u003E=1.1.0,\u003C1.21.5","source":"GitHub","reportedAt":"2026-10-05 23:26:58","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-8fxw-fmj8-xp7j"}]}],"composer\/composer":[{"advisoryId":"PKSA-ddsx-fjz2-sbs3","packageName":"composer\/composer","remoteId":"GHSA-96h3-5x6v-m776","title":"Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path","link":"https:\/\/github.com\/advisories\/GHSA-96h3-5x6v-m776","cve":"CVE-2026-59944","affectedVersions":"\u003E=1.0,\u003C2.2.30|\u003E=2.3.0,\u003C2.10.3","source":"GitHub","reportedAt":"2026-10-02 19:14:34","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-96h3-5x6v-m776"}]}],"league\/commonmark":[{"advisoryId":"PKSA-m4t9-vsgq-8khn","packageName":"league\/commonmark","remoteId":"GHSA-3q6v-r5mr-hxv8","title":"league\/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan","link":"https:\/\/github.com\/advisories\/GHSA-3q6v-r5mr-hxv8","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:13","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3q6v-r5mr-hxv8"}]},{"advisoryId":"PKSA-m2dq-1fhr-29b1","packageName":"league\/commonmark","remoteId":"GHSA-97jj-33gv-5xf9","title":"league\/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal","link":"https:\/\/github.com\/advisories\/GHSA-97jj-33gv-5xf9","cve":null,"affectedVersions":"\u003E=1.3.0,\u003C=2.10.1","source":"GitHub","reportedAt":"2026-09-30 15:36:33","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-97jj-33gv-5xf9"}]}],"jayanta\/laravel-threat-detection":[{"advisoryId":"PKSA-fq5s-jjn9-17wq","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml","title":"Credentials under prefixed or nested names stored in cleartext in the threat log","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-6gg9-q48h-56vx","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-3.yaml"}]},{"advisoryId":"PKSA-1nr4-5xd6-jgjp","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml","title":"Plaintext credentials written to the threat log and readable by any authenticated user","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-9jh8-pj82-6ccg","cve":null,"affectedVersions":"\u003C1.8.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-06 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-06-1.yaml"}]},{"advisoryId":"PKSA-j8sb-5q45-xtvw","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml","title":"Attacks go unrecorded when a request carries malformed headers or oversized fields","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-3c4c-m8xj-3vc8","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-1.yaml"}]},{"advisoryId":"PKSA-grsv-gc9r-djpk","packageName":"jayanta\/laravel-threat-detection","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml","title":"Marking a detection as a false positive could create a wider exclusion rule than intended","link":"https:\/\/github.com\/jay123anta\/laravel-threat-detection\/security\/advisories\/GHSA-rppj-hxxm-v5pr","cve":null,"affectedVersions":"\u003C1.9.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-29 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"jayanta\/laravel-threat-detection\/2026-09-29-2.yaml"}]}],"web-tp3\/wec_map":[{"advisoryId":"PKSA-yvwr-r5t5-t6jk","packageName":"web-tp3\/wec_map","remoteId":"GHSA-mqhg-c7w9-w3cv","title":"WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting","link":"https:\/\/github.com\/advisories\/GHSA-mqhg-c7w9-w3cv","cve":"CVE-2014-6296","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-mqhg-c7w9-w3cv"}]},{"advisoryId":"PKSA-cj68-qpv3-85sd","packageName":"web-tp3\/wec_map","remoteId":"GHSA-f3v6-g4mv-pjhq","title":"WEC Map (wec_map) extension for TYPO3 allows SQL Injection","link":"https:\/\/github.com\/advisories\/GHSA-f3v6-g4mv-pjhq","cve":"CVE-2014-6295","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f3v6-g4mv-pjhq"}]}]}}