Packagist package vulnerabilities
The newest vulnerabilities affecting Packagist packages, up to 200. Subscribe by RSS.
- CVE-2026-114542Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…
- CVE-2026-118539Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254Drupal Commerce Core · drupal/commerce
- CVE-2026-118540Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255Drupal Commerce Core · drupal/commerce
- CVE-2026-118541Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256Drupal Commerce Core · drupal/commerce
- CVE-2026-118542Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257Drupal Commerce Core · drupal/commerce
- CVE-2026-118543Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258Drupal Commerce Core · drupal/commerce
- CVE-2026-118544Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259Drupal Commerce Core · drupal/commerce
- CVE-2026-118555Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260Drupal Commerce License · drupal/commerce_license
- CVE-2026-118556Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261Drupal Commerce Shipping · drupal/commerce_shipping
- CVE-2026-118557Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262Drupal Commerce Shipping · drupal/commerce_shipping
- CVE-2026-118558Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263Drupal Commerce Stripe · drupal/commerce_stripe
- CVE-2026-118559Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264Drupal Commerce Stripe · drupal/commerce_stripe
- CVE-2026-118545AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266Drupal AI · drupal/ai
- CVE-2026-118546AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267Drupal AI · drupal/ai
- CVE-2026-118548AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268Drupal AI · drupal/ai
- CVE-2026-118549AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269Drupal AI · drupal/ai
- CVE-2026-118550AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270Drupal AI · drupal/ai
- CVE-2026-118551AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271Drupal AI · drupal/ai
- CVE-2026-118552AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272Drupal AI · drupal/ai
- CVE-2026-118553AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273Drupal AI · drupal/ai
- CVE-2026-118561Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274Drupal Single Content Sync · drupal/single_content_sync
- CVE-2026-118562Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275Drupal Single Content Sync · drupal/single_content_sync
- CVE-2026-118563CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276Drupal CacheFlush · drupal/cacheflush
- CVE-2026-118564PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277PayUmoney for Drupal Commerce · drupal/commerce_payumoney
- CVE-2026-118565GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278Drupal GroupEx PRO ( Daxko ) integration · drupal/groupexp…
- CVE-2026-118582CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281Drupal CAPTCHA · drupal/captcha
- CVE-2026-118569Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282Drupal Fasttoggle · drupal/fasttoggle
- CVE-2026-118570Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283Drupal Fasttoggle · drupal/fasttoggle
- CVE-2026-118574S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279Drupal S3 File System · drupal/s3fs
- CVE-2026-118567Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280Drupal Bulk Update User Roles · drupal/bulk_update_user_rol…
- CVE-2026-118572OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth_login_oa…
- CVE-2026-118575Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285Drupal Signature pad widget · drupal/sign_widget
- CVE-2026-118576Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286Drupal Stage File Proxy · drupal/stage_file_proxy
- CVE-2026-118554OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287Drupal OpenID Connect Client · drupal/oidc
- CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288Drupal Field Permissions · drupal/field_permissions
- CVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289Drupal Field Permissions · drupal/field_permissions
- CVE-2026-118573OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290Drupal OAuth2 Token Manager · drupal/oauth2_token_manager
- CVE-2026-118568Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291Drupal Content Sync · drupal/cms_content_sync
- CVE-2026-118571Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292Drupal Media Alias Display · drupal/media_alias_display
- DRUPAL-CONTRIB-2026-265This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe Adrupal/commerce_stripe
- CVE-2026-116675TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationtinymce · tinymce/tinymce
- CVE-2026-117538REDAXO before 5.21.0 Reflected XSS via Packages API function Parameterredaxo core · redaxo/source
- CVE-2026-117537REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameterredaxo core · redaxo/source
- CVE-2026-116891SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstateSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-84910Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118Drupal Advanced Search · drupal/advanced_search
- CVE-2026-84911AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119Drupal AI · drupal/ai
- CVE-2026-84912AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120Drupal AI · drupal/ai
- CVE-2026-84913AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121Drupal AI Translate · drupal/ai_translate
- CVE-2026-84914Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122Drupal Calculate Working Days · drupal/calculate_working_da…
- CVE-2026-84915Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123Drupal Component blocks · drupal/component_blocks
- CVE-2026-84916Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126Drupal Islandora · drupal/islandora
- CVE-2026-84917Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127Drupal Jsonapi Role Access · drupal/jsonapi_role_access
- CVE-2026-16648Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128Drupal Mailer Plus Log · drupal/symfony_mailer_log
- CVE-2026-81163Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129Drupal Media Library Importer · drupal/media_library_import…
- CVE-2026-84918Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130Drupal Monobank payment API · drupal/monobank
- CVE-2026-84919PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131Drupal PhotoSwipe - Responsive JavaScript Modal Image Galle…
- CVE-2026-87936amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134Drupal amazee.ai Private AI Provider · drupal/ai_provider_a…
- CVE-2026-87937Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135Drupal Central Authentication System (CAS) Server · drupal/…
- CVE-2026-87938CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136Drupal CSP log · drupal/csp_log
- CVE-2026-87939Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137Drupal Feed Block · drupal/feed_block
- CVE-2026-87940Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138Drupal Key auth · drupal/key_auth
- CVE-2026-87942SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140Drupal SafeDelete · drupal/safedelete
- CVE-2026-87943SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87944SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87945SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87946SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87947SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87948SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87949SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87950SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87951SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87952SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87953SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87954Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152Drupal Taxonomy Term Glossary · drupal/term_glossary
- CVE-2026-87955Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153Drupal Ultimate Table Field · drupal/ultimate_table_field
- CVE-2026-96360Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154Drupal Webform · drupal/webform
- CVE-2026-96361Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155Drupal Webform · drupal/webform
- CVE-2026-96358Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158Drupal Webform · drupal/webform
- CVE-2026-96359Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159Drupal Webform · drupal/webform
- CVE-2026-96362Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160Drupal Webform · drupal/webform
- CVE-2026-96363Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161Drupal Webform · drupal/webform
- CVE-2026-96367Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162Drupal Webform · drupal/webform
- CVE-2026-96368Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163Drupal Webform · drupal/webform
- CVE-2026-96370Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164Drupal Webform · drupal/webform
- CVE-2026-96369Webform - Less critical - Access bypass - SA-CONTRIB-2026-165Drupal Webform · drupal/webform
- CVE-2026-96371Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166Drupal Webform · drupal/webform
- CVE-2026-96372Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167Drupal Webform · drupal/webform
- CVE-2026-96373Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168Drupal Webform · drupal/webform
- CVE-2026-96366Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169Drupal Webform · drupal/webform
- CVE-2026-96365Webform - Less critical - Denial of service - SA-CONTRIB-2026-170Drupal Webform · drupal/webform
- CVE-2026-96364Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171Drupal Webform · drupal/webform
- CVE-2026-96357Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172Drupal Webform · drupal/webform
- CVE-2026-96398Webform - Less critical - Access bypass - SA-CONTRIB-2026-173Drupal Webform · drupal/webform
- CVE-2026-96356Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174Drupal Webform · drupal/webform
- CVE-2026-96355Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175Drupal Webform · drupal/webform
- CVE-2026-96375Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176Drupal Cloud · drupal/cloud
- CVE-2026-96376Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177Drupal Cloud · drupal/cloud
- CVE-2026-96374Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178Drupal Project Browser · drupal/project_browser
- CVE-2026-96384Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180Drupal Mermaid Diagram Field · drupal/mermaid_diagram_field
- CVE-2026-96379CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181Drupal CookieCuttr · drupal/cookiecuttr
- CVE-2026-96385REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182REST & JSON API Authentication for Drupal · drupal/rest_api…
- CVE-2026-96388Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184Drupal Tawk.to - Live chat application · drupal/tawk_to
- CVE-2026-96390Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185Drupal Editoria11y Accessibility Checker · drupal/editoria1…
- CVE-2026-96391Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186Drupal Webform REST · drupal/webform_rest
- CVE-2026-96392AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187Drupal AI CKEditor · drupal/ai_ckeditor
- CVE-2026-96377Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188Drupal Combined image style · drupal/combined_image_style
- CVE-2026-96380CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189Drupal CSS Usage Analyzer · drupal/css_usage_analyzer
- CVE-2026-96386Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190Drupal Smart Content · drupal/smart_content
- CVE-2026-96382Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191Drupal Diba carousel slider · drupal/diba_carousel
- CVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentialslaravel framework · laravel/framework
- CVE-2026-114508Laravel relationship inclusion can trigger unauthorized data destructionlaravel framework · laravel/framework
- DRUPAL-CONTRIB-2026-238This module enables you to share users, content and configuration across a group of domains from a single Drupal installation.drupal/domain
- CVE-2026-113712Cachet has Stored XSS in Incident Componentcachethq cachet · cachethq/cachet
- CVE-2026-104827react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSreactphp http · react/http
- CVE-2026-109413Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Processsensiolabs symfony · symfony/symfony +1
- CVE-2026-108082Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Headersensiolabs symfony · symfony/http-foundation +1
- CVE-2026-62858YOURLS: Unauthenticated File InclusionYOURLS · yourls/yourls
- CVE-2026-107381svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesdarylldoyle svg-sanitizer · enshrined/svg-sanitize
- CVE-2026-56826Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configurationshopperlabs shopper · shopper/framework
- CVE-2026-85990Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methodsleantime · leantime/leantime
- CVE-2026-65954PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()PHPCSStandards PHPCSUtils · phpcsstandards/phpcsutils
- CVE-2026-107851Contao: Improper access control in the table access votercontao · contao/core-bundle
- CVE-2026-107850Contao: Improper access control in the preview links modulecontao · contao/core-bundle
- CVE-2026-107848Contao: Cross-site request forgery in custom backend actionscontao · contao/core-bundle
- CVE-2026-107845Contao: Cross-site scripting in the comments bundlecontao · contao/comments-bundle
- CVE-2026-107844Contao: Path traversal in the images controllercontao · contao/core-bundle
- CVE-2026-107843Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha checkcontao · contao/core-bundle
- CVE-2026-107842Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledcontao · contao/core-bundle
- CVE-2026-107380enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collisiondarylldoyle svg-sanitizer · enshrined/svg-sanitize
- CVE-2026-107379enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crashdarylldoyle svg-sanitizer · enshrined/svg-sanitize
- CVE-2026-107376webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested inputwebonyx graphql-php · webonyx/graphql-php
- CVE-2026-105830league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParserthephpleague commonmark · league/commonmark
- CVE-2026-105829League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypassthephpleague commonmark · league/commonmark
- CVE-2026-104890Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code executionKunstmaanBundlesCMS · kunstmaan bundles-cms +3
- CVE-2026-104473YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpagesyeswiki · yeswiki/yeswiki
- CVE-2026-104181Filament: Multi-factor authentication (app) management actions do not require password reauthenticationfilamentphp filament · filament/filament
- CVE-2026-55224MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/UninstallMineAdmin · mineadmin/mineadmin
- CVE-2026-102601Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterthephpleague flysystem · league/flysystem
- CVE-2026-102279Laravel: XSS in Debug Page Informationlaravel framework · laravel/framework
- CVE-2026-100909OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgeryOctoberCMS · october/october
- CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolationAzuraCast · azuracast/azuracast
- CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay PasswordAzuraCast · azuracast/azuracast
- CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /playAzuraCast · azuracast/azuracast
- CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap APIAzuraCast · azuracast/azuracast
- CVE-2026-92161FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerFriendsOfFlarum oauth · fof/oauth
- CVE-2026-57440Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledStarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…
- CVE-2026-61823code16 Sharp vulnerable to stored XSS via iframe srcdoc Attributecode16 sharp · code16/sharp
- CVE-2026-61825code16/sharp has a stored XSS via data-html-content Sanitizer Bypasscode16 sharp · code16/sharp
- CVE-2026-61816zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEzbateson mail-mime-parser · zbateson/mail-mime-parser
- CVE-2026-61815zbateson/mail-mime-parser has CRLF header injection via attachment filenamezbateson mail-mime-parser · zbateson/mail-mime-parser
- CVE-2026-62368Snipe-IT: Stored XSS via Custom Field name in asset-list column headersgrokability snipe-it · snipe/snipe-it
- CVE-2026-63493Snipe-IT: 2FA bypass via the API token flowgrokability snipe-it · snipe/snipe-it
- CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumerationthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertionthorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-63498Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIgrokability snipe-it · snipe/snipe-it
- CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factorthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submissionthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-76087Formie: Unauthenticated users can overwrite incomplete submissions via submit actionverbb formie · verbb/formie
- CVE-2026-76086Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsverbb formie · verbb/formie
- CVE-2026-76089Formie: Missing authorization on sent notification resend modal exposes submission PIIverbb formie · verbb/formie
- CVE-2026-92692Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)sulu · sulu/sulu
- CVE-2026-73858Solspace Freeform: Limited Twig template injection via submitted field valuessolspace craft-freeform · solspace/craft-freeform
- CVE-2026-88974WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostwp-graphql · wp-graphql/wp-graphql
- CVE-2026-63000REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updatesredaxo core · redaxo/source
- CVE-2026-62998REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumerationredaxo core · redaxo/source
- CVE-2026-63002REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenamesredaxo core · redaxo/source
- CVE-2026-63001REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`redaxo core · redaxo/source
- CVE-2026-71537Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)Paymenter · paymenter/paymenter
- GHSA-JR78-W6W5-M8F8Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasksmediawiki/semantic-media-wiki
- CVE-2026-77616Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77610Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)SemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77609Semantic MediaWiki has an open redirect in Special:URIResolverSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77607Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSSSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77608Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)SemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77606Semantic MediaWiki has reflected XSS in Special:Ask plain table headersSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2025-61682Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-45140Chamilo LMS CStudio upload flow allows unauthenticated remote code executionchamilo-lms · chamilo/chamilo-lms
- CVE-2026-79752CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectioncakephp · cakephp/database +1
- CVE-2026-59944Composer: CVE-2026-59946 fix bypass via symlinked package bin pathcomposer · composer/composer
- CVE-2026-84997react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPUreactphp http · react/http
- CVE-2026-56830Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorizationshopperlabs shopper · shopper/framework
- CVE-2026-56831Shopper: Negative discount values accepted and propagated through order calculation pipelineshopperlabs shopper · shopper/framework
- CVE-2026-56827Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliersshopperlabs shopper · shopper/framework
- CVE-2026-56829Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentshopperlabs shopper · shopper/framework
- CVE-2026-56825Shopper: Missing authorization on product removal actions in CollectionProducts componentshopperlabs shopper · shopper/framework
- CVE-2026-55374canto-saas-api: Authenticated API requests can be redirected via unencoded path variablesjleehr canto-saas-api · jleehr/canto-saas-api
- CVE-2026-55375canto-saas-api: OAuth credentials exposed in URL query string and exception messagesjleehr canto-saas-api · jleehr/canto-saas-api
- CVE-2026-55691EmbedVideo Extension : Stored XSS via unsanitized class passed to templateStarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…
- CVE-2026-55690EmbedVideo Extension: Stored XSS via unsanitized service name in exception textStarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…
- CVE-2026-55692EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabledStarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…
- CVE-2026-52827Kimai: Two-factor authentication bypass on the Kimai APIkimai · kimai/kimai
- CVE-2026-52822Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocationkimai · kimai/kimai
- CVE-2026-52828Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Accesskimai · kimai/kimai
- CVE-2026-52826Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulationkimai · kimai/kimai
- CVE-2026-52823Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changeskimai · kimai/kimai
- CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacketpmmp PocketMine-MP · pocketmine/pocketmine-mp