Advisory Catalog

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf: Chroot Validation Bypass

Guzzle: URI fragments disclosed in redirect Referer headers

Guzzle: Host-only cookie scope is not preserved

Guzzle: Unbounded response cookies risk denial of service

Guzzle: Proxy-Authorization headers can be sent to origin servers

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor has an authenticated terminal command whitelist bypass

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with s

The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`. This vulnerability is mitigated by the fact that Drupal must be configured to use a contr

MantisBT: Stored XSS in print_all_bug_page_word.php

MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

MantisBT: Reflected XSS in admin/install.php via unescaped printf

MantisBT: Reflected XSS in admin/install.php

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Koel has SSRF through Authenticated Subsonic podcast feed URLs

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

MantisBT: REST API unauthorized Issue status change

MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT: SQL Injection via history_order Configuration Value

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

TYPO3 CMS - Unrestricted File Upload in Form Framework

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover