EZSA-2018-006 XSS vulnerability in 'disabled module' error template

More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template...

Privilege Escalation & SQL Injection in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

SS-2018-014: Dangerous file types in allowed upload

More info at https://www.silverstripe.org/download/security-releases/ss-2018-014/...

SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms

More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...

SS-2017-006: Session user agent change detection

More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...

SS-2017-007: CSV Excel Macro Injection

More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...

XSS in class documenting_xmlrpc_server

More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...

Information Disclosure in TYPO3 CMS

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-006/...

Remote Code Execution in Qquoteadv/controllers/DownloadController.php

More info at https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction...

Cross-Site Scripting in TYPO3 CMS

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-003/...

Cross-Site Scripting vulnerability in typolinks

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-018...

Privilege Escalation in TYPO3 CMS

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-012/...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

Remote File Inclusion through View template name manipulation

More info at https://bakery.cakephp.org/2015/11/05/cakephp30153142612276released.html...

Filesystem Permissions Issues in Multiple Components

More info at https://framework.zend.com/security/advisory/ZF2015-07...

SS-2015-015: XSS in dev/build returnURL Parameter

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-015/...

Information Disclosure possibility exploitable by Editors

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/...

SS-2015-013: X-Forwarded-Host request hostname injection

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...

Denial of Service attack through XML payloads

More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...

Exploit in the private channel authentication

More info at https://blog.pusher.com/update-on-security/...

Arbitrary Shell Execution in Swiftmailer library

More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...

Risk of mass-assignment vulnerabilities

More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.29...

Potential XSS vector in multiple view helpers

More info at https://framework.zend.com/security/advisory/ZF2014-03...

Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer

More info at https://framework.zend.com/security/advisory/ZF2014-02...

Vulnerability in the filesystem loader

More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...

Potential SQL injection due to execution of platform-specific SQL containing interpolations

More info at https://framework.zend.com/security/advisory/ZF2013-03...

Route Parameter Injection Via Query String in Zend\Mvc

More info at https://framework.zend.com/security/advisory/ZF2013-01...

Potential Proxy Injection Vulnerabilities in Multiple Zend Framework 2 Components

More info at https://framework.zend.com/security/advisory/ZF2012-04...

SQL injection possibility

More info at https://www.doctrine-project.org/blog/dbal-security-2011-1.html...

Potential SQL Injection Vector When Using PDO_MySql

More info at https://framework.zend.com/security/advisory/ZF2011-02...

CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

More info at https://symfony.com/cve-2026-45073...

Authentication bypass via attacker provided openid server

Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server. Patches This vulnerability only affects the outdated v1.x versions of the package. These are no longer...

CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

More info at https://symfony.com/cve-2026-45304...

Contextual Links validation - Critical - Remote Code Execution

More info at https://www.drupal.org/sa-core-2018-006...

Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012

More info at https://www.drupal.org/sa-core-2019-012...

Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001

More info at https://www.drupal.org/sa-core-2020-001...

Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009

More info at https://www.drupal.org/sa-core-2019-009...

CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

More info at https://symfony.com/cve-2026-45064...

Signature validation bypass

More info at https://simplesamlphp.org/security/201710-01...

symfony/ux-icons XSS via unsanitized SVG content in local files and Iconify on-demand responses

Description The uxicon Twig function is marked issafe='html', so Twig never escapes its output. Icon::toHtml inlines the SVG source verbatim into the page. Browsers execute elements and on event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site...

TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-018...

TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-015...

TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-014...

TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-013...

TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-012...

TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting

More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...

JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

Summary JWSVerifier::getAlgorithm in src/Library/Signature/JWSVerifier.php line 144 merges protected and unprotected headers using PHP's spread operator: php $completeHeader = ...$signature-getProtectedHeader, ...$signature-getHeader; In PHP, when spreading arrays with duplicate string keys, the...

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

More info at https://symfony.com/cve-2026-48736...

Host confusion via authority reinterpretation

Impact guzzlehttp/psr7 improperly interpreted malformed Host header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal...