Advisory Catalog

symfony/ux-live-component: XSS via attacker-controlled child component tag

symfony/ux-live-component: Denial of service via unbounded batch action requests

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

Kirby: `pages.access` permission is not checked in the `site/find` REST API route

Kirby: Access to files of top-level drafts is not protected by permissions

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

Kirby: Request header injection in `Http\Remote`

Kirby: Self cross-site scripting (self-XSS) in the writer field

Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module

Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

Cotonti: Cross-Site Request Forgery in the administration rights handler

CakePHP: View::element() is missing a path containment check

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploa

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.

Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in c

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserial

[SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentia

CakePHP Authentication: Open redirect weakness via backslash bypass

Filament: Disabled RichEditor field state can be used for XSS

Laravel Framework: Temporary Signed URL Path Confusion

Laravel Framework: CRLF injection in default email rule

phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

Slim has Reflected XSS in the HtmlErrorRenderer

Koillection has an authenticated Server-Side Request Forgery issue

shlink has a Server-Side Request Forgery issue