{"advisories":{"aptoma\/twig-markdown":[{"advisoryId":"PKSA-pth7-jz73-t51g","packageName":"aptoma\/twig-markdown","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-APTOMATWIGMARKDOWN-8400480","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.4.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-10-31 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"aptoma\/twig-markdown\/2024-10-31.yaml"}]}],"pattern-lab\/drupal-twig-components":[{"advisoryId":"PKSA-xhgb-v99m-4h6n","packageName":"pattern-lab\/drupal-twig-components","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-PATTERNLABDRUPALTWIGCOMPONENTS-8400872","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=2.2.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"pattern-lab\/drupal-twig-components\/2024-11-04.yaml"}]}],"j0k3r\/httplug-ssrf-plugin":[{"advisoryId":"PKSA-px1b-j2dd-31r6","packageName":"j0k3r\/httplug-ssrf-plugin","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml","title":"Server-side Request Forgery (SSRF)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-J0K3RHTTPLUGSSRFPLUGIN-8400871","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=3.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"j0k3r\/httplug-ssrf-plugin\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/add-attributes-twig-extension":[{"advisoryId":"PKSA-wczj-fvbh-sqgr","packageName":"drupal-pattern-lab\/add-attributes-twig-extension","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABADDATTRIBUTESTWIGEXTENSION-8400879","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/add-attributes-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/bem-twig-extension":[{"advisoryId":"PKSA-9j51-377g-2f4j","packageName":"drupal-pattern-lab\/bem-twig-extension","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABBEMTWIGEXTENSION-8400878","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=1.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/bem-twig-extension\/2024-11-04.yaml"}]}],"drupal-pattern-lab\/unified-twig-extensions":[{"advisoryId":"PKSA-13v9-rks1-fwdd","packageName":"drupal-pattern-lab\/unified-twig-extensions","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml","title":"Cross-site Scripting (XSS)","link":"https:\/\/security.snyk.io\/vuln\/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877","cve":null,"affectedVersions":"\u003E=0.0.0,\u003C=0.1.0","source":"FriendsOfPHP\/security-advisories","reportedAt":"2024-11-04 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"drupal-pattern-lab\/unified-twig-extensions\/2024-11-04.yaml"}]}],"typo3\/cms-form":[{"advisoryId":"PKSA-fykt-pmbg-txnv","packageName":"typo3\/cms-form","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml","title":"TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2026-024","cve":"CVE-2026-109162","affectedVersions":"\u003E=14.0.0,\u003C14.3.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-13 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"typo3\/cms-form\/CVE-2026-109162.yaml"}]}],"contao\/comments-bundle":[{"advisoryId":"PKSA-c42s-m9fj-8jxw","packageName":"contao\/comments-bundle","remoteId":"GHSA-628f-v4f6-p37r","title":"Contao: Cross-site scripting in the comments bundle","link":"https:\/\/github.com\/advisories\/GHSA-628f-v4f6-p37r","cve":"CVE-2026-107845","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-628f-v4f6-p37r"}]}],"contao\/core-bundle":[{"advisoryId":"PKSA-b5qj-hq3z-3ry8","packageName":"contao\/core-bundle","remoteId":"GHSA-5974-gfqc-wrcm","title":"Contao: Improper access control in the table access voter","link":"https:\/\/github.com\/advisories\/GHSA-5974-gfqc-wrcm","cve":"CVE-2026-107851","affectedVersions":"\u003E=5.7.0,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:42","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5974-gfqc-wrcm"}]},{"advisoryId":"PKSA-7n2q-445d-xssj","packageName":"contao\/core-bundle","remoteId":"GHSA-q6wp-fr43-gm9v","title":"Contao: Improper access control in the preview links module","link":"https:\/\/github.com\/advisories\/GHSA-q6wp-fr43-gm9v","cve":"CVE-2026-107850","affectedVersions":"\u003E=5.7.1,\u003C5.7.12","source":"GitHub","reportedAt":"2026-10-09 20:53:46","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q6wp-fr43-gm9v"}]},{"advisoryId":"PKSA-6j5h-bxmj-94h9","packageName":"contao\/core-bundle","remoteId":"GHSA-mrvp-7wmx-5m4h","title":"Contao: Path traversal in the images controller","link":"https:\/\/github.com\/advisories\/GHSA-mrvp-7wmx-5m4h","cve":"CVE-2026-107844","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:53:55","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mrvp-7wmx-5m4h"}]},{"advisoryId":"PKSA-6ymc-kdpm-qx87","packageName":"contao\/core-bundle","remoteId":"GHSA-9ff2-p842-45wq","title":"Contao: Cross-site request forgery in custom backend actions","link":"https:\/\/github.com\/advisories\/GHSA-9ff2-p842-45wq","cve":"CVE-2026-107848","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:00","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-9ff2-p842-45wq"}]},{"advisoryId":"PKSA-s71c-hg32-kv3f","packageName":"contao\/core-bundle","remoteId":"GHSA-mfxh-vp55-7gc6","title":"Contao: The registration module re-sends activation mails","link":"https:\/\/github.com\/advisories\/GHSA-mfxh-vp55-7gc6","cve":"CVE-2026-107843","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.1.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:04","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mfxh-vp55-7gc6"}]},{"advisoryId":"PKSA-bmqh-y7sv-p1st","packageName":"contao\/core-bundle","remoteId":"GHSA-x2rp-9qf7-2fmq","title":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled","link":"https:\/\/github.com\/advisories\/GHSA-x2rp-9qf7-2fmq","cve":"CVE-2026-107842","affectedVersions":"\u003E=5.4.0-RC1,\u003C5.7.12|\u003E=4.0.0,\u003C5.3.50","source":"GitHub","reportedAt":"2026-10-09 20:54:09","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x2rp-9qf7-2fmq"}]}],"enshrined\/svg-sanitize":[{"advisoryId":"PKSA-cbx2-m9db-bmzd","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-v383-3rw5-q8rf","title":"enshrined\/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","link":"https:\/\/github.com\/advisories\/GHSA-v383-3rw5-q8rf","cve":"CVE-2026-107379","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:05","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-v383-3rw5-q8rf"}]},{"advisoryId":"PKSA-6j95-1jtb-x6wc","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-m9xh-6747-9r6f","title":"svg-sanitizer: Mixed-case xlink:HrEf skips the `\u003Cuse\u003E` nesting-DoS check in Resolver::processReferences","link":"https:\/\/github.com\/advisories\/GHSA-m9xh-6747-9r6f","cve":"CVE-2026-107381","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:10","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-m9xh-6747-9r6f"}]},{"advisoryId":"PKSA-8j6w-3kr7-s9xk","packageName":"enshrined\/svg-sanitize","remoteId":"GHSA-9rjx-3jch-6vjf","title":"enshrined\/svg-sanitize: Stored XSS via DTD Entity \/ HTML5 Named Character Reference Collision","link":"https:\/\/github.com\/advisories\/GHSA-9rjx-3jch-6vjf","cve":"CVE-2026-107380","affectedVersions":"\u003C=0.22.0","source":"GitHub","reportedAt":"2026-10-08 19:41:15","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9rjx-3jch-6vjf"}]}],"kunstmaan\/media-bundle":[{"advisoryId":"PKSA-qzt5-rxz6-8qm6","packageName":"kunstmaan\/media-bundle","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"kunstmaan\/bundles-cms":[{"advisoryId":"PKSA-c8mp-7f4z-q7q5","packageName":"kunstmaan\/bundles-cms","remoteId":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","link":"https:\/\/github.com\/advisories\/GHSA-p279-5wcv-45vq","cve":"CVE-2026-104890","affectedVersions":"\u003C7.3.2","source":"GitHub","reportedAt":"2026-10-07 18:05:38","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-p279-5wcv-45vq"}]}],"web-tp3\/wec_map":[{"advisoryId":"PKSA-yvwr-r5t5-t6jk","packageName":"web-tp3\/wec_map","remoteId":"GHSA-mqhg-c7w9-w3cv","title":"WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting","link":"https:\/\/github.com\/advisories\/GHSA-mqhg-c7w9-w3cv","cve":"CVE-2014-6296","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-mqhg-c7w9-w3cv"}]},{"advisoryId":"PKSA-cj68-qpv3-85sd","packageName":"web-tp3\/wec_map","remoteId":"GHSA-f3v6-g4mv-pjhq","title":"WEC Map (wec_map) extension for TYPO3 allows SQL Injection","link":"https:\/\/github.com\/advisories\/GHSA-f3v6-g4mv-pjhq","cve":"CVE-2014-6295","affectedVersions":"\u003C3.0.3","source":"GitHub","reportedAt":"2022-05-17 04:31:53","composerRepository":null,"severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-f3v6-g4mv-pjhq"}]}]}}