Retrieval of HTTP-only cookies

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

Cross-Site Scripting in Language Pack Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...

Cross-Site Scripting in Fluid ViewHelpers

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...

Broken Access Control in Localization Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...

Broken Access Control in Localization Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...

Information Disclosure of Installed Extensions

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...

SS-2018-008: BackURL validation bypass with malformed URLs

More info at https://www.silverstripe.org/download/security-releases/ss-2018-008/...

Crypt encryption compromised.

More info at https://fuelphp.com/security-advisories...

Information Disclosure in TYPO3 CMS

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-005/...

Missing state parameter in OAuth requests leading to CSRF vulnerability

More info at https://github.com/sensiolabs/connect/pull/63...

Remote Code Execution Vulnerability

More info at https://community.shopware.com/detail1989.html...

Time-Based Information Disclosure Vulnerability in Flow

More info at https://www.neos.io/blog/flow-sa-2016-001.html...

Link injection

More info at https://simplesamlphp.org/security/201606-01...

Arbitrary File Disclosure in Form Component

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-010/...

SS-2015-028: Missing security check on dev/build/defaults

More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...

Cross-Site Scripting in TYPO3 component Indexed Search

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/...

XSS vulnerabilities in Neos

More info at https://www.neos.io/blog/neos-sa-2015-002.html...

Potential SQL injection vector using null byte for PDO (MsSql, SQLite)

More info at https://framework.zend.com/security/advisory/ZF2015-08...

Frontend: Unauthenticated Path Disclosure

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-008/...

State guessing vulnerability

By doing this we're protecting against people trying to guess the state...

Access bypass when editing file metadata

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...

SS-2015-011: Potential SQL Injection Vulnerability

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...

Privilege Escalation in TYPO3 Neos

More info at https://www.neos.io/blog/neos-sa-2015-001.html...

SS-2016-012: Missing ACL on reports

More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...

Attackers able to impersonate users

Merge branch 'disabling-none-by-default'...

Arbitrary Shell Execution in Swiftmailer library

More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...

Entropy is lost in the TokenGenerator

More info at https://symfony.com/blog/fosuserbundle-entropy-of-generated-tokens-is-lost...

Authentication adapter did not verify validity of tokens

Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...

Hijacked authentication cookies vulnerability

More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...

Possible DOS attack with long user-submitted passwords

More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...

Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components

More info at https://framework.zend.com/security/advisory/ZF2013-02...

Request::getClientIp() when the trust proxy mode is enabled

More info at https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4...

Potential XSS Vectors in Multiple Zend Framework 2 Components

More info at https://framework.zend.com/security/advisory/ZF2012-03...

Fixed the user refreshing to check the identity by primary key instead of username

Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...

XML decoding attack vector through external entities

More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...

Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution

More info at https://www.drupal.org/sa-core-2018-006...

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

More info at https://www.drupal.org/sa-core-2020-013...

Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009

More info at https://www.drupal.org/sa-core-2019-009...

Content moderation - Moderately critical - Access bypass

More info at https://www.drupal.org/sa-core-2018-006...

Padding Oracle Vulnerability in RSA Encryption

See https://framework.zend.com/security/advisory/ZF2015-10 it's essentially the same vulnerability...

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005

More info at https://www.drupal.org/sa-core-2021-005...

CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

More info at https://symfony.com/cve-2026-45305...

CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection

More info at https://symfony.com/cve-2026-45755...

CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

More info at https://symfony.com/cve-2026-45065...

Prevent installation typosquatting malware

More info at https://www.kernelmode.blog/typosquatting-malware-found-in-composer-repository/...

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-918: Server-Side Request Forgery SSRF CVSS vector v.3.1: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS vector v.4.0: 8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description: SSRF occurs when a processed HTML document is read and...

PHP Code Injection

phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...

Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012

More info at https://www.drupal.org/sa-core-2019-012...

TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...

TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...