{"advisories":{"cachethq\/cachet":[{"advisoryId":"PKSA-b73h-txx9-5t8m","packageName":"cachethq\/cachet","remoteId":"GHSA-x397-5hrv-j9m9","title":"Cachet has Stored XSS in Incident Component","link":"https:\/\/github.com\/advisories\/GHSA-x397-5hrv-j9m9","cve":"CVE-2026-113712","affectedVersions":"\u003C=2.4.1","source":"GitHub","reportedAt":"2026-10-20 21:09:40","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x397-5hrv-j9m9"}]}],"kitodo\/presentation":[{"advisoryId":"PKSA-ggns-sv2d-stv8","packageName":"kitodo\/presentation","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml","title":"TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension \u0022Kitodo.Presentation\u0022 (dlf)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-032","cve":"CVE-2026-112237","affectedVersions":"\u003E=7.0.0,\u003C7.0.2|\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml"}]}],"blueways\/bw-captcha":[{"advisoryId":"PKSA-rwzb-f3sr-qs44","packageName":"blueways\/bw-captcha","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml","title":"TYPO3-EXT-SA-2026-030: Captcha Bypass in extension \u0022Accessible Form Captcha\u0022 (bw_captcha)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-030","cve":"CVE-2026-112067","affectedVersions":"\u003E=4.0.0,\u003C5.4.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml"}]}],"causal\/fal-protect":[{"advisoryId":"PKSA-6z5d-zh8g-4pfj","packageName":"causal\/fal-protect","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml","title":"TYPO3-EXT-SA-2026-028: Broken Access Control in extension \u0022FAL Protect\u0022 (fal_protect)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-028","cve":"CVE-2026-112069","affectedVersions":"\u003E=1.7.1,\u003C1.8.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml"}]}],"sgalinski\/sg-cookie-optin":[{"advisoryId":"PKSA-s32p-q272-ns98","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml","title":"TYPO3-EXT-SA-2026-029: SQL Injection in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112064","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml"}]},{"advisoryId":"PKSA-xc65-qxpn-2x5q","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112065","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml"}]},{"advisoryId":"PKSA-1t7r-3wn1-dsjs","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112066","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml"}]}],"t3g\/analytics":[{"advisoryId":"PKSA-x737-v31s-48yt","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml","title":"TYPO3-EXT-SA-2026-031: Broken Access Control in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112070","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml"}]},{"advisoryId":"PKSA-f25v-jzn7-jv3q","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml","title":"TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112068","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml"}]}],"nitsan\/ns-t3ai":[{"advisoryId":"PKSA-bvhd-xth6-k5xw","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml","title":"TYPO3-EXT-SA-2026-035: Broken Access Control in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-112239","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml"}]},{"advisoryId":"PKSA-kk39-vqqg-74n6","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml","title":"TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-113459","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml"}]}],"ameos\/ameos_filemanager":[{"advisoryId":"PKSA-jx7x-rkr7-n2tb","packageName":"ameos\/ameos_filemanager","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml","title":"TYPO3-EXT-SA-2026-034: SQL Injection in extension \u0022File manager\u0022 (ameos_filemanager)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-034","cve":"CVE-2026-112238","affectedVersions":"\u003C3.1.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml"}]}],"codingms\/shop":[{"advisoryId":"PKSA-qcjp-qhjx-bgmg","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-113468.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-113468","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-113468.yaml"}]},{"advisoryId":"PKSA-8c1z-qtpy-x6zn","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-112071.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-112071","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-112071.yaml"}]}],"codingms\/fluid-form":[{"advisoryId":"PKSA-s8v1-krjv-23c8","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml","title":"TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-113442","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml"}]},{"advisoryId":"PKSA-13xq-tz75-c2tq","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml","title":"TYPO3-EXT-SA-2026-033: Broken Access Control in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-112240","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml"}]}],"litesaml\/lightsaml":[{"advisoryId":"PKSA-n3jt-6ytb-s57s","packageName":"litesaml\/lightsaml","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml","title":"Signature validation bypass","link":"https:\/\/github.com\/litesaml\/lightsaml\/security\/advisories\/GHSA-rm7m-7jq4-gw46","cve":null,"affectedVersions":"\u003E=6.0.0,\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-16 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml"}]}],"yourls\/yourls":[{"advisoryId":"PKSA-grvh-n5s5-5dmb","packageName":"yourls\/yourls","remoteId":"GHSA-f8ff-652m-j5rx","title":"YOURLS: Unauthenticated File Inclusion","link":"https:\/\/github.com\/advisories\/GHSA-f8ff-652m-j5rx","cve":"CVE-2026-62858","affectedVersions":"\u003C=1.10.4","source":"GitHub","reportedAt":"2026-10-15 20:13:02","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-f8ff-652m-j5rx"}]}],"leantime\/leantime":[{"advisoryId":"PKSA-vxb4-5j8y-5cbx","packageName":"leantime\/leantime","remoteId":"GHSA-54mm-6729-r5wp","title":"Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods","link":"https:\/\/github.com\/advisories\/GHSA-54mm-6729-r5wp","cve":"CVE-2026-85990","affectedVersions":"\u003C3.10.0","source":"GitHub","reportedAt":"2026-10-15 20:14:43","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-54mm-6729-r5wp"}]}],"react\/http":[{"advisoryId":"PKSA-y8pw-63n4-d3gg","packageName":"react\/http","remoteId":"GHSA-g4f2-2pf3-2pwj","title":"react\/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","link":"https:\/\/github.com\/advisories\/GHSA-g4f2-2pf3-2pwj","cve":"CVE-2026-104827","affectedVersions":"\u003E=1.0.0,\u003C=1.11.0","source":"GitHub","reportedAt":"2026-10-15 20:09:56","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-g4f2-2pf3-2pwj"}]}],"symfony\/http-foundation":[{"advisoryId":"PKSA-xmwy-rmx5-m7h4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml"}]}],"symfony\/symfony":[{"advisoryId":"PKSA-fyjn-dgwp-4tt3","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml"}]},{"advisoryId":"PKSA-zxg3-vspd-sr38","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109449.yaml"}]},{"advisoryId":"PKSA-5gdh-tt4n-ckh2","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml"}]}],"symfony\/yaml":[{"advisoryId":"PKSA-xz3r-9gp4-4m1z","packageName":"symfony\/yaml","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml"}]}],"symfony\/expression-language":[{"advisoryId":"PKSA-vq1j-sc3k-jzzk","packageName":"symfony\/expression-language","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml","title":"CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109449","cve":"CVE-2026-109449","affectedVersions":"\u003E=2.4.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.48|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.21|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-14 08:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/expression-language\/CVE-2026-109449.yaml"}]}],"filament\/filament":[{"advisoryId":"PKSA-cnr1-6g7k-bp3d","packageName":"filament\/filament","remoteId":"GHSA-7m6h-rg42-m449","title":"Filament: Multi-factor authentication (app) management actions do not require password reauthentication","link":"https:\/\/github.com\/advisories\/GHSA-7m6h-rg42-m449","cve":"CVE-2026-104181","affectedVersions":"\u003E=5.0.0,\u003C=5.8.2|\u003E=4.0.0,\u003C=4.13.2","source":"GitHub","reportedAt":"2026-10-05 23:44:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7m6h-rg42-m449"}]}]}}