Advisory Catalog

Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Solspace Freeform: Limited Twig template injection via submitted field values

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki has an open redirect in Special:URIResolver

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts Drupal](https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp). Vulnerabilities are possible if Drupal is configur

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

October CMS: Incomplete Scheme Validation in Image Resizer

October CMS: PHP Object Injection via Backend Widget Session Storage

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopping privilege escalation through missing authorization in Settings components

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Composer arbitrary command execution via a malicious package's Perforce source URL

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

Filament: Password validity disclosure for accounts denied panel access on login page

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Sulu: Stored XSS via media download inline-disposition override

Sulu: Media move/update authorization bypass (IDOR)

Sulu: Fix authorization bypass when creating preview links