State guessing vulnerability

By doing this we're protecting against people trying to guess the state...

Insecure state generation

More info at https://github.com/laravel/socialite/pull/91...

Brute Force Protection Bypass in backend login

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...

SS-2015-011: Potential SQL Injection Vulnerability

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...

XXE Vulnerability

Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...

Privilege Escalation in TYPO3 Neos

More info at https://www.neos.io/blog/neos-sa-2015-001.html...

SS-2016-008: Password encryption salt expiry

More info at https://www.silverstripe.org/download/security-releases/ss-2016-008/...

SS-2015-009: XSS In rewritten hash links

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-009-xss-in-rewritten-hash-links/...

SS-2014-015: IE requests not properly behaving with rewritehashlinks

More info at https://www.silverstripe.org/software/download/security-releases/ss-2014-015-ie-requests-not-properly-behaving-with-rewritehashlinks/...

Possible cache poisining on the homepage when anchors are used

More info at https://typo3.org/security/advisory/typo3-core-sa-2014-003...

Potential SQL injection in the ORDER implementation of Zend_Db_Select

More info at https://framework.zend.com/security/advisory/ZF2014-04...

SecurityComponent cross form submission issue

More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...

Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse

More info at https://framework.zend.com/security/advisory/ZF2014-01...

Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse

More info at https://framework.zend.com/security/advisory/ZF2014-01...

Possible DOS attack with long user-submitted passwords

More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...

Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components

More info at https://framework.zend.com/security/advisory/ZF2013-02...

Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component

More info at https://framework.zend.com/security/advisory/ZF2012-05...

Request::getClientIp() when the trust proxy mode is enabled

More info at https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4...

Potential XSS Vectors in Multiple Zend Framework 2 Components

More info at https://framework.zend.com/security/advisory/ZF2012-03...

Fixed the user refreshing to check the identity by primary key instead of username

Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...

Potential XSS in Development Environment Error View Script

More info at https://framework.zend.com/security/advisory/ZF2011-01...

Potential Security Issues in Bundled Dojo Library

More info at https://framework.zend.com/security/advisory/ZF2010-07...

XSS vector in Zend_Filter_StripTags

More info at https://framework.zend.com/security/advisory/ZF2009-02...

Vulnerability to bypass two-factor authentication with remember-me option

Bundle version: 4.10.0 Symfony version: 3.4.31 Description Bypass 2fa by rememberme cookie To Reproduce We have a login form with rememberme checkbox functionality, When using the checkbox, symfony creates a cookie "REMEMBERME". That moment we get redirected to the 2fa-auth page. We have no acces...

CVE-2026-45069: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

More info at https://symfony.com/cve-2026-45069...

CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

More info at https://symfony.com/cve-2026-48760...

Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011

More info at https://www.drupal.org/sa-core-2019-011...

Content moderation - Moderately critical - Access bypass

More info at https://www.drupal.org/sa-core-2018-006...

Guard bypass in Eloquent models

More info at https://blog.laravel.com/security-release-laravel-61834-7232...

CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

More info at https://symfony.com/cve-2026-45077...

CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

More info at https://symfony.com/cve-2026-45305...

CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient

More info at https://symfony.com/cve-2024-50342...

External URL injection through URL aliases - Moderately Critical - Open Redirect

More info at https://www.drupal.org/sa-core-2018-006...

Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

More info at https://symfony.com/cve-2026-46629...

Cookie serialization vulnerability

More info at https://laravel.com/docs/5.6/upgradeupgrade-5.6.30...

TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-018...

TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-016...

TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-011...

TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-010...

TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-009...

TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...

TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...

Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

Summary OTPHP\Factory::loadFromProvisioningUri parses an attacker-supplied otpauth:// URI and forwards every query key to OTP::setParameter$key, $value. setParameter resolves the name with propertyexists$this, $parameter and performs a dynamic write $this-$parameter = $value src/OTP.php:196-197...

Host confusion via authority reinterpretation

Impact guzzlehttp/psr7 improperly interpreted malformed Host header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal...

SQL Injection in extension "News system" (news)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-010...

TYPO3-EXT-SA-2026-012: SQL Injection in extension "Address List" (tt_address)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-012...

TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...

Argument injection via newline in PHP INI values forwarded to child processes

Impact PHPUnit forwards PHP INI settings to child processes used for isolated/PHPT test execution as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newli...

Insufficient nonce entropy

Impact Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.phpL192. This can leave servers vulnerable to replay attacks when TLS is not used. Patches Upgrade to version 0.8.1 or higher...

Possible SQL injection in widget field value

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...