Advisory Catalog

WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens

Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

October Rain has Stored XSS via SVG Filter Bypass

October Rain has Environment Variable Exfiltration via INI Parser Interpolation

Composer has a command injection via malicious perforce repository

Composer has a command injection via malicious perforce reference

October CMS has Stored XSS in Event Log Mail Preview

October CMS has Stored XSS in Backend Editor Markup Classes

October Rain has a Twig Sandbox Bypass via Collection Methods

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

Kimai leaks API Token Hash via Invoice Twig Template

Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments

LibreNMS: Cross-Site Scripting in ShowConfigController

Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)

REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)

Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens

CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization

CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List

CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

yaffa vulnerable to Cross Site Scripting

PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state

PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module

Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module

Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module

Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module

Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module

Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter