1961 matches found
Cross-site scripting in the figure insert tag (see GHSA-pc2r-hvrc-f4v6)
More info at https://github.com/contao/contao/security/advisories/GHSA-pc2r-hvrc-f4v6...
NoPrivateNetworkExceptRootPagesHttpClient does not pin the checked IP of cached hosts (see GHSA-wvj5-rchg-986m)
More info at https://github.com/contao/contao/security/advisories/GHSA-wvj5-rchg-986m...
NoPrivateNetworkExceptRootPagesHttpClient does not pin the checked IP of cached hosts (see GHSA-wvj5-rchg-986m)
More info at https://github.com/contao/contao/security/advisories/GHSA-wvj5-rchg-986m...
Server-side request forgery via unvalidated feed URL in the legacy RSS reader module (see GHSA-4mx5-xq7q-77cm)
More info at https://github.com/contao/contao/security/advisories/GHSA-4mx5-xq7q-77cm...
Server-side request forgery via unvalidated feed URL in the legacy RSS reader module (see GHSA-4mx5-xq7q-77cm)
More info at https://github.com/contao/contao/security/advisories/GHSA-4mx5-xq7q-77cm...
Contao crawler leaks confidental headers (see GHSA-26h3-f97j-vj85)
More info at https://github.com/contao/contao/security/advisories/GHSA-26h3-f97j-vj85...
Filemount access-control bypass in DC_Folder::editAll (see GHSA-9jfh-v443-w3fj)
More info at https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj...
Insufficient scope validation for passkey authentication (see GHSA-5mw8-wv8h-h6hx)
More info at https://github.com/contao/contao/security/advisories/GHSA-5mw8-wv8h-h6hx...
Insufficient scope validation for passkey authentication (see GHSA-5mw8-wv8h-h6hx)
More info at https://github.com/contao/contao/security/advisories/GHSA-5mw8-wv8h-h6hx...
Insufficient CSRF protection for backend login (see GHSA-rgq4-cg48-xjxj)
More info at https://github.com/contao/contao/security/advisories/GHSA-rgq4-cg48-xjxj...
Session invalidation upon enabling or disabling 2FA (see GHSA-5mg3-mv6j-57wc)
More info at https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc...
Path traversal via decode-after-check in the image insert tag (see GHSA-r7cf-mfp4-r23h)
More info at https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h...
Filemount access-control bypass in DC_Folder::editAll (see GHSA-9jfh-v443-w3fj)
More info at https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj...
Contao crawler leaks confidental headers (see GHSA-26h3-f97j-vj85)
More info at https://github.com/contao/contao/security/advisories/GHSA-26h3-f97j-vj85...
Stored cross-site scripting in the file manager via crafted filenames (see GHSA-xh3r-77ch-frm3)
More info at https://github.com/contao/contao/security/advisories/GHSA-xh3r-77ch-frm3...
Path traversal via decode-after-check in the image insert tag (see GHSA-r7cf-mfp4-r23h)
More info at https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h...
HTML sanitizer is vulnerable to DOM clobbering (see GHSA-58r4-2p86-jp4x)
More info at https://github.com/contao/contao/security/advisories/GHSA-58r4-2p86-jp4x...
Insert tag injection in the breadcrumb module on 404 pages (see GHSA-6m74-9w88-r3fh)
More info at https://github.com/contao/contao/security/advisories/GHSA-6m74-9w88-r3fh...
HTML sanitizer is vulnerable to DOM clobbering (see GHSA-58r4-2p86-jp4x)
More info at https://github.com/contao/contao/security/advisories/GHSA-58r4-2p86-jp4x...
Insert tag injection in the breadcrumb module on 404 pages (see GHSA-6m74-9w88-r3fh)
More info at https://github.com/contao/contao/security/advisories/GHSA-6m74-9w88-r3fh...
Stored cross-site scripting in the file manager via crafted filenames (see GHSA-xh3r-77ch-frm3)
More info at https://github.com/contao/contao/security/advisories/GHSA-xh3r-77ch-frm3...
Insufficient CSRF protection for backend login (see GHSA-rgq4-cg48-xjxj)
More info at https://github.com/contao/contao/security/advisories/GHSA-rgq4-cg48-xjxj...
Cross-site scripting in the figure insert tag (see GHSA-pc2r-hvrc-f4v6)
More info at https://github.com/contao/contao/security/advisories/GHSA-pc2r-hvrc-f4v6...
Session invalidation upon enabling or disabling 2FA (see GHSA-5mg3-mv6j-57wc)
More info at https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc...
AAD parameter not correctly bound in File cryptography
More info at https://github.com/paragonie/halite/security/advisories/GHSA-jw8x-c445-phrm...
TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
TYPO3-EXT-SA-2026-037: Open Redirection in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-038...
TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-037...
EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents
More info at https://github.com/doctrine/mongodb-odm/security/advisories/GHSA-cr6x-45gj-q6f5...
phpseclib unbounded PBKDF iteration count in encrypted key/PFX/CMS parsing enables CPU-exhaustion DoS
More info at https://github.com/phpseclib/phpseclib/security/advisories/GHSA-w3p9-g4p2-h3rr...
gRPC PHP: bundled CA store trusts compromised eMudhra intermediate CAs
More info at https://github.com/grpc/grpc/security/advisories/GHSA-gvrc-7wf9-p7hg...
SS-2026-001 - Template injection RCE in userforms
More info at https://www.silverstripe.org/download/security-releases/ss-2026-001...
CVE-2026-88992 - Userforms CSV export restricted file access
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88992...
SS-2026-006 - RCE via template string escaping in userforms email subject
More info at https://www.silverstripe.org/download/security-releases/ss-2026-006...
SS-2026-005 - XSS in required field label
More info at https://www.silverstripe.org/download/security-releases/ss-2026-005...
CVE-2026-88991 - RCE in email subject field via template execution
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88991...
CVE-2026-91111 - Uploaded XML XSS
More info at https://www.silverstripe.org/download/security-releases/cve-2026-91111...
CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField
More info at https://www.silverstripe.org/download/security-releases/cve-2026-91114...
CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter
More info at https://www.silverstripe.org/download/security-releases/cve-2026-91115...
CVE-2026-88988 - XSS via SVG data URI
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88988...
CVE-2026-91110 - XSS using control bytes
More info at https://www.silverstripe.org/download/security-releases/cve-2026-91110...
CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change
More info at https://www.silverstripe.org/download/security-releases/cve-2026-91113...
CVE-2026-88989 - Auth bypass GridFieldDetailForm
More info at https://www.silverstripe.org/download/security-releases/cve-2026-88989...
SS-2026-004 - Password reset token account takeover
More info at https://www.silverstripe.org/download/security-releases/ss-2026-004...