Advisory Catalog

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

h2: Duplicate Host header could facilitate request smuggling

Craft CMS: Authenticated leak of secret environment variables

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Craft CMS: Incorrect path validation could potentially lead to path traversal

Craft CMS: Stored XSS in the control panel via unescaped draft name

PHP_CodeSniffer gitblame report command injection via crafted filename

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

league/commonmark: Denial of service via deeply nested XML output

league/commonmark: Denial of service via colliding heading slugs

league/commonmark: Denial of service via duplicate footnote definitions

league/commonmark: Denial of service via adjacent inline attribute blocks

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Silverstripe: XSS in breadcrumbs in page list view

Nx: Zip-Slip in the self-hosted remote cache

Mermaid radar diagrams are vulnerable to DoS

Mermaid configuration APIs allow prototype pollution

Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid XY Charts are vulnerable to an infinite loop DoS

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic: Account takeover via OAuth email matching without email-verification check

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence