{"advisories":{"laravel\/framework":[{"advisoryId":"PKSA-b41t-wbzk-9q51","packageName":"laravel\/framework","remoteId":"GHSA-f9x3-7vq9-cph6","title":"Laravel TokenGuard authentication bypass through non-string API credentials","link":"https:\/\/github.com\/advisories\/GHSA-f9x3-7vq9-cph6","cve":"CVE-2026-114509","affectedVersions":"\u003C12.68.0|\u003E=13.0.0,\u003C13.29.0","source":"GitHub","reportedAt":"2026-10-23 21:50:27","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-f9x3-7vq9-cph6"}]},{"advisoryId":"PKSA-4hy6-m98j-dz9f","packageName":"laravel\/framework","remoteId":"GHSA-5wcm-3v2w-8362","title":"Laravel relationship inclusion can trigger unauthorized data destruction","link":"https:\/\/github.com\/advisories\/GHSA-5wcm-3v2w-8362","cve":"CVE-2026-114508","affectedVersions":"\u003E=13.0.0,\u003C13.27.0|\u003E=12.45.0,\u003C12.68.0","source":"GitHub","reportedAt":"2026-10-23 21:47:48","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-5wcm-3v2w-8362"}]}],"livewire\/livewire":[{"advisoryId":"PKSA-xhv3-nr94-h8db","packageName":"livewire\/livewire","remoteId":"GHSA-mhf7-xp6r-6qrc","title":"Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order","link":"https:\/\/github.com\/advisories\/GHSA-mhf7-xp6r-6qrc","cve":null,"affectedVersions":"\u003E=4.3.0,\u003C4.4.8","source":"GitHub","reportedAt":"2026-10-23 20:51:30","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-mhf7-xp6r-6qrc"}]}],"cachethq\/cachet":[{"advisoryId":"PKSA-b73h-txx9-5t8m","packageName":"cachethq\/cachet","remoteId":"GHSA-x397-5hrv-j9m9","title":"Cachet has Stored XSS in Incident Component","link":"https:\/\/github.com\/advisories\/GHSA-x397-5hrv-j9m9","cve":"CVE-2026-113712","affectedVersions":"\u003C=2.4.1","source":"GitHub","reportedAt":"2026-10-20 21:09:40","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-x397-5hrv-j9m9"}]}],"kitodo\/presentation":[{"advisoryId":"PKSA-ggns-sv2d-stv8","packageName":"kitodo\/presentation","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml","title":"TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension \u0022Kitodo.Presentation\u0022 (dlf)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-032","cve":"CVE-2026-112237","affectedVersions":"\u003E=7.0.0,\u003C7.0.2|\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"kitodo\/presentation\/CVE-2026-112237.yaml"}]}],"blueways\/bw-captcha":[{"advisoryId":"PKSA-rwzb-f3sr-qs44","packageName":"blueways\/bw-captcha","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml","title":"TYPO3-EXT-SA-2026-030: Captcha Bypass in extension \u0022Accessible Form Captcha\u0022 (bw_captcha)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-030","cve":"CVE-2026-112067","affectedVersions":"\u003E=4.0.0,\u003C5.4.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"blueways\/bw-captcha\/CVE-2026-112067.yaml"}]}],"causal\/fal-protect":[{"advisoryId":"PKSA-6z5d-zh8g-4pfj","packageName":"causal\/fal-protect","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml","title":"TYPO3-EXT-SA-2026-028: Broken Access Control in extension \u0022FAL Protect\u0022 (fal_protect)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-028","cve":"CVE-2026-112069","affectedVersions":"\u003E=1.7.1,\u003C1.8.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"causal\/fal-protect\/CVE-2026-112069.yaml"}]}],"sgalinski\/sg-cookie-optin":[{"advisoryId":"PKSA-s32p-q272-ns98","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml","title":"TYPO3-EXT-SA-2026-029: SQL Injection in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112064","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112064.yaml"}]},{"advisoryId":"PKSA-xc65-qxpn-2x5q","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112065","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112065.yaml"}]},{"advisoryId":"PKSA-1t7r-3wn1-dsjs","packageName":"sgalinski\/sg-cookie-optin","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml","title":"TYPO3-EXT-SA-2026-029: Missing Authorization in extension \u0022sgalinski Cookie Consent\u0022 (sg_cookie_optin)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-029","cve":"CVE-2026-112066","affectedVersions":"\u003E=8.0.0,\u003C8.1.12|\u003C7.4.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sgalinski\/sg-cookie-optin\/CVE-2026-112066.yaml"}]}],"t3g\/analytics":[{"advisoryId":"PKSA-x737-v31s-48yt","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml","title":"TYPO3-EXT-SA-2026-031: Broken Access Control in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112070","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112070.yaml"}]},{"advisoryId":"PKSA-f25v-jzn7-jv3q","packageName":"t3g\/analytics","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml","title":"TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension \u0022Analytics\u0022 (analytics)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-031","cve":"CVE-2026-112068","affectedVersions":"\u003C1.1.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"t3g\/analytics\/CVE-2026-112068.yaml"}]}],"nitsan\/ns-t3ai":[{"advisoryId":"PKSA-bvhd-xth6-k5xw","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml","title":"TYPO3-EXT-SA-2026-035: Broken Access Control in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-112239","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-112239.yaml"}]},{"advisoryId":"PKSA-kk39-vqqg-74n6","packageName":"nitsan\/ns-t3ai","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml","title":"TYPO3-EXT-SA-2026-035: Sensitive Data Exposure in extension \u0022TYPO3 AI Integration Extension\u0022 (ns_t3ai)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-035","cve":"CVE-2026-113459","affectedVersions":"\u003C14.0.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"nitsan\/ns-t3ai\/CVE-2026-113459.yaml"}]}],"ameos\/ameos_filemanager":[{"advisoryId":"PKSA-jx7x-rkr7-n2tb","packageName":"ameos\/ameos_filemanager","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml","title":"TYPO3-EXT-SA-2026-034: SQL Injection in extension \u0022File manager\u0022 (ameos_filemanager)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-034","cve":"CVE-2026-112238","affectedVersions":"\u003C3.1.3","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"ameos\/ameos_filemanager\/CVE-2026-112238.yaml"}]}],"codingms\/shop":[{"advisoryId":"PKSA-qcjp-qhjx-bgmg","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-113468.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-113468","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-113468.yaml"}]},{"advisoryId":"PKSA-8c1z-qtpy-x6zn","packageName":"codingms\/shop","remoteId":"codingms\/shop\/CVE-2026-112071.yaml","title":"TYPO3-EXT-SA-2026-036: Broken Access Control in extension \u0022TYPO3 Shop by coding.ms\u0022 (shop)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-036","cve":"CVE-2026-112071","affectedVersions":"\u003E=6.0.0,\u003C6.3.0|\u003E=5.0.0,\u003C5.21.1|\u003C4.9.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/shop\/CVE-2026-112071.yaml"}]}],"codingms\/fluid-form":[{"advisoryId":"PKSA-s8v1-krjv-23c8","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml","title":"TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-113442","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-113442.yaml"}]},{"advisoryId":"PKSA-13xq-tz75-c2tq","packageName":"codingms\/fluid-form","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml","title":"TYPO3-EXT-SA-2026-033: Broken Access Control in extension \u0022TYPO3 Fluid-Form by coding.ms\u0022 (fluid_form)","link":"https:\/\/news.typo3.com\/security\/advisory\/typo3-ext-sa-2026-033","cve":"CVE-2026-112240","affectedVersions":"\u003E=6.0.0,\u003C6.0.6|\u003C5.0.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-20 09:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"codingms\/fluid-form\/CVE-2026-112240.yaml"}]}],"litesaml\/lightsaml":[{"advisoryId":"PKSA-n3jt-6ytb-s57s","packageName":"litesaml\/lightsaml","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml","title":"Signature validation bypass","link":"https:\/\/github.com\/litesaml\/lightsaml\/security\/advisories\/GHSA-rm7m-7jq4-gw46","cve":null,"affectedVersions":"\u003E=6.0.0,\u003C6.0.1","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-16 00:00:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"litesaml\/lightsaml\/2026-10-16-1.yaml"}]}],"filament\/filament":[{"advisoryId":"PKSA-cnr1-6g7k-bp3d","packageName":"filament\/filament","remoteId":"GHSA-7m6h-rg42-m449","title":"Filament: Multi-factor authentication (app) management actions do not require password reauthentication","link":"https:\/\/github.com\/advisories\/GHSA-7m6h-rg42-m449","cve":"CVE-2026-104181","affectedVersions":"\u003E=5.0.0,\u003C=5.8.2|\u003E=4.0.0,\u003C=4.13.2","source":"GitHub","reportedAt":"2026-10-05 23:44:12","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-7m6h-rg42-m449"}]}]}}