Advisory Catalog

symfony/ux-live-component: XSS via attacker-controlled child component tag

symfony/ux-live-component: Denial of service via unbounded batch action requests

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

Kirby: Access to files of top-level drafts is not protected by permissions

Kirby: Request header injection in `Http\Remote`

Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

CakePHP: View::element() is missing a path containment check

The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploa

Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in c

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserial

[SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentia

CakePHP Authentication: Open redirect weakness via backslash bypass

Laravel Framework: Temporary Signed URL Path Confusion

phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

Slim has Reflected XSS in the HtmlErrorRenderer

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Microweber vulnerable to Path Traversal

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

guzzlehttp/psr7 has CRLF Injection via URI Host Component

Sharp Missing Authorization Check in Quick Creation Command Endpoints

BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR

TYPO3 CMS has Insecure Deserialization via Core API

TYPO3 CMS has Broken Access Control in Backend API

TYPO3 CMS: Broken Access Control in Media Module

TYPO3 CMS has Broken Access Control in its DataHandler

TYPO3 CMS has Broken Access Control in the Recycler Module

TYPO3 CMS has Cross-Site Scripting in Indexed Search

TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities