Advisory Catalog

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

Statamic Vulnerable to CSV formula injection in form submission exports

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

Tiptap contains an input validation vulnerability resulting in DoS

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

Snipe-IT has Improper Authorization in File Deletion (IDOR)

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT has a 2FA reset privilege bypass

Snipe-IT Vulnerable to User Account Escalation via CSV Import

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT's selectlist visibility is too permissive

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

Filament: Unauthenticated temporary file upload on auth pages

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

Filament: Timing-based user enumeration on login page

Paymenter has broken object level authorization via service reference manipulation on ticket creation

Paymenter doesn't reset email verification status after email change

Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

symfony/ux-autocomplete: XSS via unescaped AJAX response data

symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted

symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil