Advisory Catalog

EGroupware has Authenticated RCE via Malicious eTemplate Upload

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

SimpleSAMLphp has Possible DoS via XPath Transform

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Kimai Password Reset Link Remains Valid After Password Change

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

Tiptap contains an input validation vulnerability resulting in DoS

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

Kirby: `pages.access` permission is not checked in the `site/find` REST API route

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

Kirby: Self cross-site scripting (self-XSS) in the writer field

Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module

Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Filament: Disabled RichEditor field state can be used for XSS

Laravel Framework: CRLF injection in default email rule

Koillection has an authenticated Server-Side Request Forgery issue

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Concrete CMS: PHP Object Injection via unserialize() calls

BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter