{"advisories":{"adminneo-org\/adminneo":[{"advisoryId":"PKSA-1q5j-gcpm-qr2y","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-wm25-49w3-5qrg","title":"AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery","link":"https:\/\/github.com\/advisories\/GHSA-wm25-49w3-5qrg","cve":"CVE-2026-96629","affectedVersions":"\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:51:29","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-wm25-49w3-5qrg"}]},{"advisoryId":"PKSA-z44r-b4tk-ggk6","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-q5mp-gfjf-cf2j","title":"AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)","link":"https:\/\/github.com\/advisories\/GHSA-q5mp-gfjf-cf2j","cve":"CVE-2026-96630","affectedVersions":"\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:51:37","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-q5mp-gfjf-cf2j"}]},{"advisoryId":"PKSA-jqcq-6phr-785g","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-rx7m-wxwq-vxr9","title":"AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)","link":"https:\/\/github.com\/advisories\/GHSA-rx7m-wxwq-vxr9","cve":"CVE-2026-96632","affectedVersions":"\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:52:23","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-rx7m-wxwq-vxr9"}]},{"advisoryId":"PKSA-31n1-gk84-zwsg","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-79wv-8rh2-9vp2","title":"AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers","link":"https:\/\/github.com\/advisories\/GHSA-79wv-8rh2-9vp2","cve":"CVE-2026-96631","affectedVersions":"\u003E=4.6.0,\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:52:47","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-79wv-8rh2-9vp2"}]},{"advisoryId":"PKSA-crwk-5zq2-p7sx","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-6vfx-w7q3-42gq","title":"AdminNeo SQLite Database-List Drop Arbitrary File Deletion","link":"https:\/\/github.com\/advisories\/GHSA-6vfx-w7q3-42gq","cve":"CVE-2026-96633","affectedVersions":"\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:52:58","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-6vfx-w7q3-42gq"}]},{"advisoryId":"PKSA-3qwh-zmfw-wy96","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-p96f-p2p2-2g3h","title":"AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE","link":"https:\/\/github.com\/advisories\/GHSA-p96f-p2p2-2g3h","cve":"CVE-2026-96634","affectedVersions":"\u003C5.5.1","source":"GitHub","reportedAt":"2026-10-30 22:53:08","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-p96f-p2p2-2g3h"}]},{"advisoryId":"PKSA-j37s-v4jh-54ry","packageName":"adminneo-org\/adminneo","remoteId":"GHSA-jm85-8cpp-9cjc","title":"AdminNeo: version-cache array injection causes persistent denial of service","link":"https:\/\/github.com\/advisories\/GHSA-jm85-8cpp-9cjc","cve":"CVE-2026-59978","affectedVersions":"\u003E=4.6.2,\u003C5.5.0","source":"GitHub","reportedAt":"2026-10-30 18:53:08","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-jm85-8cpp-9cjc"}]}],"silverstripe\/mfa":[{"advisoryId":"PKSA-xxk3-rjxm-jftv","packageName":"silverstripe\/mfa","remoteId":"GHSA-68wq-phq7-p2vg","title":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","link":"https:\/\/github.com\/advisories\/GHSA-68wq-phq7-p2vg","cve":"CVE-2026-55186","affectedVersions":"\u003C6.0.0","source":"GitHub","reportedAt":"2026-10-29 16:32:39","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-68wq-phq7-p2vg"}]}],"pocketmine\/pocketmine-mp":[{"advisoryId":"PKSA-3kvf-7m4g-79bw","packageName":"pocketmine\/pocketmine-mp","remoteId":"GHSA-pg53-p7qp-65cv","title":"PocketMine-MP has potential memory\/network vulnerability from repeated ResourcePackClientResponsePacket packets","link":"https:\/\/github.com\/advisories\/GHSA-pg53-p7qp-65cv","cve":null,"affectedVersions":"\u003C5.44.2","source":"GitHub","reportedAt":"2026-10-29 16:32:58","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-pg53-p7qp-65cv"}]}],"tinymce\/tinymce":[{"advisoryId":"PKSA-bdqg-yq3b-xsg6","packageName":"tinymce\/tinymce","remoteId":"GHSA-mf2p-h6hf-fcwm","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","link":"https:\/\/github.com\/advisories\/GHSA-mf2p-h6hf-fcwm","cve":"CVE-2026-116675","affectedVersions":"=7.9.3|\u003E=8.5.1,\u003C8.9.3","source":"GitHub","reportedAt":"2026-10-27 21:07:12","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-mf2p-h6hf-fcwm"}]}],"phpoffice\/phpspreadsheet":[{"advisoryId":"PKSA-zb3c-6qhx-m249","packageName":"phpoffice\/phpspreadsheet","remoteId":"GHSA-rxj4-h86g-25gc","title":"PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service","link":"https:\/\/github.com\/advisories\/GHSA-rxj4-h86g-25gc","cve":"CVE-2026-108357","affectedVersions":"\u003E=3.3.0,\u003C=3.10.7|\u003E=4.0.0,\u003C=5.9.0","source":"GitHub","reportedAt":"2026-10-27 15:38:22","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-rxj4-h86g-25gc"}]},{"advisoryId":"PKSA-96jv-mtjg-g2v8","packageName":"phpoffice\/phpspreadsheet","remoteId":"GHSA-3x94-m842-937c","title":"PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service","link":"https:\/\/github.com\/advisories\/GHSA-3x94-m842-937c","cve":"CVE-2026-108358","affectedVersions":"\u003C=1.30.6|\u003E=2.0.0,\u003C=2.1.18|\u003E=2.2.0,\u003C=2.4.7|\u003E=3.3.0,\u003C=3.10.7|\u003E=4.0.0,\u003C=5.9.0","source":"GitHub","reportedAt":"2026-10-27 15:38:28","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-3x94-m842-937c"}]},{"advisoryId":"PKSA-dxd5-wy68-pq29","packageName":"phpoffice\/phpspreadsheet","remoteId":"GHSA-j2w7-387v-m2rq","title":"PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated \u2192 CPU \u0026 Memory Exhaustion (DoS)","link":"https:\/\/github.com\/advisories\/GHSA-j2w7-387v-m2rq","cve":"CVE-2026-108359","affectedVersions":"\u003C=1.30.6|\u003E=2.0.0,\u003C=2.1.18|\u003E=2.2.0,\u003C=2.4.7|\u003E=3.3.0,\u003C=3.10.7|\u003E=4.0.0,\u003C=5.9.0","source":"GitHub","reportedAt":"2026-10-27 15:38:33","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-j2w7-387v-m2rq"}]},{"advisoryId":"PKSA-r15m-kszr-8n8q","packageName":"phpoffice\/phpspreadsheet","remoteId":"GHSA-2phh-27fw-q4gc","title":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","link":"https:\/\/github.com\/advisories\/GHSA-2phh-27fw-q4gc","cve":"CVE-2026-108360","affectedVersions":"\u003C=1.30.6|\u003E=2.0.0,\u003C=2.1.18|\u003E=2.2.0,\u003C=2.4.7|\u003E=3.3.0,\u003C=3.10.7|\u003E=4.0.0,\u003C=5.9.0","source":"GitHub","reportedAt":"2026-10-27 15:38:39","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-2phh-27fw-q4gc"}]},{"advisoryId":"PKSA-x13r-n4wc-4gcr","packageName":"phpoffice\/phpspreadsheet","remoteId":"GHSA-84wq-86v6-x5j6","title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader","link":"https:\/\/github.com\/advisories\/GHSA-84wq-86v6-x5j6","cve":"CVE-2026-40863","affectedVersions":"\u003C=1.30.5|\u003E=2.0.0,\u003C=2.1.15|\u003E=2.2.0,\u003C=2.4.4|\u003E=3.3.0,\u003C=3.10.4|\u003E=4.0.0,\u003C=5.6.0","source":"GitHub","reportedAt":"2026-04-29 20:23:27","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-84wq-86v6-x5j6"}]}],"dolibarr\/dolibarr":[{"advisoryId":"PKSA-w1dm-r75t-7cq5","packageName":"dolibarr\/dolibarr","remoteId":"GHSA-v5fq-cf5m-vwv7","title":"Dolibarr has SQL Injection in societe\/class\/societe.class.php via localtax1_value parameter","link":"https:\/\/github.com\/advisories\/GHSA-v5fq-cf5m-vwv7","cve":"CVE-2026-33944","affectedVersions":"\u003C=23.0.0","source":"GitHub","reportedAt":"2026-10-27 13:29:25","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-v5fq-cf5m-vwv7"}]},{"advisoryId":"PKSA-bc6q-cg7z-6rnf","packageName":"dolibarr\/dolibarr","remoteId":"GHSA-2mfj-r695-5h9r","title":"Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php ","link":"https:\/\/github.com\/advisories\/GHSA-2mfj-r695-5h9r","cve":"CVE-2026-34036","affectedVersions":"\u003C23.0.0","source":"GitHub","reportedAt":"2026-03-27 18:04:19","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-2mfj-r695-5h9r"}]}],"sylius\/sylius":[{"advisoryId":"PKSA-qzkx-mfzr-b1gq","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-cqw6-3fwg-cfv4.yaml","title":"Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers\u0027 data","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-cqw6-3fwg-cfv4","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.17|\u003E=2.2.0,\u003C2.2.12|\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:23:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-cqw6-3fwg-cfv4.yaml"}]},{"advisoryId":"PKSA-nq9j-9tdc-rmf5","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/CVE-2026-100869.yaml","title":"CVE-2026-100869: Shop API accepts arbitrary PaymentRequest actions, allowing a customer-triggered refund","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-2rv4-pjmm-7fxf","cve":"CVE-2026-100869","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.16|\u003E=2.2.0,\u003C2.2.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-02 13:50:48","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/CVE-2026-100869.yaml"}]},{"advisoryId":"PKSA-b7q9-vk2h-x54x","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/CVE-2026-100871.yaml","title":"CVE-2026-100871: JWT audience confusion allows shop customer to authenticate as administrator","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-f6mx-qxjc-55xf","cve":"CVE-2026-100871","affectedVersions":"\u003E=1.11.0,\u003C1.12.0|\u003E=1.12.0,\u003C1.12.25|\u003E=1.13.0,\u003C1.13.17|\u003E=1.14.0,\u003C1.14.20|\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.16|\u003E=2.2.0,\u003C2.2.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-02 13:28:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/CVE-2026-100871.yaml"}]},{"advisoryId":"PKSA-bqq7-pykv-vwcc","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/CVE-2026-100870.yaml","title":"CVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token theft","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-77w3-2367-7xvq","cve":"CVE-2026-100870","affectedVersions":"\u003E=1.12.0,\u003C1.12.25|\u003E=1.13.0,\u003C1.13.17|\u003E=1.14.0,\u003C1.14.20|\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.16|\u003E=2.2.0,\u003C2.2.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-02 13:28:00","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/CVE-2026-100870.yaml"}]},{"advisoryId":"PKSA-kkj2-twt4-2665","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-mw28-p745-4jrv.yaml","title":"A disabled API stays reachable through a percent-encoded path","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-mw28-p745-4jrv","cve":null,"affectedVersions":"\u003E=1.9.6,\u003C1.10.0|\u003E=1.10.1,\u003C1.11.0|\u003E=1.11.0,\u003C1.12.0|\u003E=1.12.0,\u003C1.13.0|\u003E=1.13.0,\u003C1.14.0|\u003E=1.14.0,\u003C1.14.21|\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.17|\u003E=2.2.0,\u003C2.2.12|\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:20:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-mw28-p745-4jrv.yaml"}]},{"advisoryId":"PKSA-mhzj-n1yw-fvjm","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/CVE-2026-100872.yaml","title":"CVE-2026-100872: Order total can be inflated after a Payment Request has started a gateway transaction, marking the order fully paid","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-vv4h-q2x8-74g4","cve":"CVE-2026-100872","affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.16|\u003E=2.2.0,\u003C2.2.9","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-02 13:50:48","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/CVE-2026-100872.yaml"}]},{"advisoryId":"PKSA-m1mn-d52b-bcqs","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-5mpg-w6q2-2vrw.yaml","title":"Unpublished product reviews disclosed through the Shop API item endpoint","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-5mpg-w6q2-2vrw","cve":null,"affectedVersions":"\u003E=1.9.0,\u003C1.10.0|\u003E=1.10.0,\u003C1.11.0|\u003E=1.11.0,\u003C1.12.0|\u003E=1.12.0,\u003C1.13.0|\u003E=1.13.0,\u003C1.14.0|\u003E=1.14.0,\u003C1.14.21|\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.17|\u003E=2.2.0,\u003C2.2.12|\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:20:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-5mpg-w6q2-2vrw.yaml"}]},{"advisoryId":"PKSA-8ckb-ddkt-f3gz","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-ccgh-6w73-crf8.yaml","title":"Channel-based payment method restriction bypass on shop payment request API endpoint","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-ccgh-6w73-crf8","cve":null,"affectedVersions":"\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.17|\u003E=2.2.0,\u003C2.2.12|\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:23:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-ccgh-6w73-crf8.yaml"}]},{"advisoryId":"PKSA-78zd-mp8b-y5gw","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-v78h-66q4-h9px.yaml","title":"Host header injection in the shop password reset e-mail link when the channel has no hostname","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-v78h-66q4-h9px","cve":null,"affectedVersions":"\u003E=1.9.0,\u003C1.10.0|\u003E=1.10.0,\u003C1.11.0|\u003E=1.11.0,\u003C1.12.0|\u003E=1.12.0,\u003C1.13.0|\u003E=1.13.0,\u003C1.14.0|\u003E=1.14.0,\u003C1.14.21|\u003E=2.0.0,\u003C2.1.0|\u003E=2.1.0,\u003C2.1.17|\u003E=2.2.0,\u003C2.2.12|\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:20:43","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-v78h-66q4-h9px.yaml"}]},{"advisoryId":"PKSA-dth6-kz6z-9v4f","packageName":"sylius\/sylius","remoteId":"sylius\/sylius\/GHSA-h76r-rr27-3gm4.yaml","title":"Promotion and coupon usage limit bypass via race condition","link":"https:\/\/github.com\/Sylius\/Sylius\/security\/advisories\/GHSA-h76r-rr27-3gm4","cve":null,"affectedVersions":"\u003E=2.3.0,\u003C2.3.2","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-22 15:40:31","composerRepository":"https:\/\/packagist.org","severity":null,"sources":[{"name":"FriendsOfPHP\/security-advisories","remoteId":"sylius\/sylius\/GHSA-h76r-rr27-3gm4.yaml"}]}],"phpunit\/phpunit":[{"advisoryId":"PKSA-qhjm-rpqc-qkn6","packageName":"phpunit\/phpunit","remoteId":"phpunit\/phpunit\/CVE-2026-119193.yaml","title":"PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling","link":"https:\/\/github.com\/sebastianbergmann\/phpunit\/security\/advisories\/GHSA-9vw2-f4vp-x7gf","cve":"CVE-2026-119193","affectedVersions":"\u003E=13.4.0,\u003C13.4.4","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-27 03:15:38","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-9vw2-f4vp-x7gf"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"phpunit\/phpunit\/CVE-2026-119193.yaml"}]}],"symfony\/http-foundation":[{"advisoryId":"PKSA-xmwy-rmx5-m7h4","packageName":"symfony\/http-foundation","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-r925-mgvr-h9cc"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/http-foundation\/CVE-2026-108082.yaml"}]}],"symfony\/symfony":[{"advisoryId":"PKSA-fyjn-dgwp-4tt3","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-2v3c-qxhr-7vpv"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-109413.yaml"}]},{"advisoryId":"PKSA-5gdh-tt4n-ckh2","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml","title":"CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","link":"https:\/\/symfony.com\/cve-2026-108082","cve":"CVE-2026-108082","affectedVersions":"\u003E=5.4.1,\u003C5.4.54|\u003E=6.0.1,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.46|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.19|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.7","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-09-15 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-r925-mgvr-h9cc"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-108082.yaml"}]},{"advisoryId":"PKSA-qgpb-b2wz-rty6","packageName":"symfony\/symfony","remoteId":"symfony\/symfony\/CVE-2026-45070.yaml","title":"CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names","link":"https:\/\/symfony.com\/cve-2026-45070","cve":"CVE-2026-45070","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.55|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.49|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.22|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 18:08:54","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-vqc8-7275-q272"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/symfony\/CVE-2026-45070.yaml"}]}],"symfony\/yaml":[{"advisoryId":"PKSA-xz3r-9gp4-4m1z","packageName":"symfony\/yaml","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml","title":"CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","link":"https:\/\/symfony.com\/cve-2026-109413","cve":"CVE-2026-109413","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.54|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.45|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.18|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.6","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-08-30 08:00:00","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-2v3c-qxhr-7vpv"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/yaml\/CVE-2026-109413.yaml"}]}],"notrinos\/notrinos-erp":[{"advisoryId":"PKSA-6c2y-dycw-7c38","packageName":"notrinos\/notrinos-erp","remoteId":"GHSA-qv4m-m73m-8hj7","title":"NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee \u0022Documents\u0022 (doc_file)","link":"https:\/\/github.com\/advisories\/GHSA-qv4m-m73m-8hj7","cve":"CVE-2026-76913","affectedVersions":"\u003C=1.0.0","source":"GitHub","reportedAt":"2026-07-10 19:34:03","composerRepository":"https:\/\/packagist.org","severity":"high","sources":[{"name":"GitHub","remoteId":"GHSA-qv4m-m73m-8hj7"}]}],"wwbn\/avideo":[{"advisoryId":"PKSA-rftd-5wbt-6qx1","packageName":"wwbn\/avideo","remoteId":"GHSA-8whc-2wmv-ww35","title":"WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin","link":"https:\/\/github.com\/advisories\/GHSA-8whc-2wmv-ww35","cve":"CVE-2026-54458","affectedVersions":"\u003C29.1.0","source":"GitHub","reportedAt":"2026-06-04 18:57:50","composerRepository":"https:\/\/packagist.org","severity":"critical","sources":[{"name":"GitHub","remoteId":"GHSA-8whc-2wmv-ww35"}]}],"symfony\/mime":[{"advisoryId":"PKSA-wtxr-p26d-nn42","packageName":"symfony\/mime","remoteId":"symfony\/mime\/CVE-2026-45070.yaml","title":"CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names","link":"https:\/\/symfony.com\/cve-2026-45070","cve":"CVE-2026-45070","affectedVersions":"\u003E=2.0.0,\u003C3.0.0|\u003E=3.0.0,\u003C4.0.0|\u003E=4.0.0,\u003C5.0.0|\u003E=5.0.0,\u003C5.1.0|\u003E=5.1.0,\u003C5.2.0|\u003E=5.2.0,\u003C5.3.0|\u003E=5.3.0,\u003C5.4.0|\u003E=5.4.0,\u003C5.4.55|\u003E=6.0.0,\u003C6.1.0|\u003E=6.1.0,\u003C6.2.0|\u003E=6.2.0,\u003C6.3.0|\u003E=6.3.0,\u003C6.4.0|\u003E=6.4.0,\u003C6.4.49|\u003E=7.0.0,\u003C7.1.0|\u003E=7.1.0,\u003C7.2.0|\u003E=7.2.0,\u003C7.3.0|\u003E=7.3.0,\u003C7.4.0|\u003E=7.4.0,\u003C7.4.22|\u003E=8.0.0,\u003C8.1.0|\u003E=8.1.0,\u003C8.1.10","source":"FriendsOfPHP\/security-advisories","reportedAt":"2026-10-28 18:08:54","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-vqc8-7275-q272"},{"name":"FriendsOfPHP\/security-advisories","remoteId":"symfony\/mime\/CVE-2026-45070.yaml"}]}],"facturascripts\/facturascripts":[{"advisoryId":"PKSA-zck8-p11k-g1qj","packageName":"facturascripts\/facturascripts","remoteId":"GHSA-q7f2-rv22-2xgr","title":"FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload\/Download","link":"https:\/\/github.com\/advisories\/GHSA-q7f2-rv22-2xgr","cve":"CVE-2026-27892","affectedVersions":"\u003C2026","source":"GitHub","reportedAt":"2026-05-07 19:33:48","composerRepository":"https:\/\/packagist.org","severity":"medium","sources":[{"name":"GitHub","remoteId":"GHSA-q7f2-rv22-2xgr"}]},{"advisoryId":"PKSA-qm4y-jdfc-4pmf","packageName":"facturascripts\/facturascripts","remoteId":"GHSA-gq5c-rw37-g46c","title":"FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation","link":"https:\/\/github.com\/advisories\/GHSA-gq5c-rw37-g46c","cve":"CVE-2026-27964","affectedVersions":"\u003E=2025.11,\u003C2025.81|\u003C2025.8","source":"GitHub","reportedAt":"2026-05-07 19:34:28","composerRepository":"https:\/\/packagist.org","severity":"low","sources":[{"name":"GitHub","remoteId":"GHSA-gq5c-rw37-g46c"}]}]}}