1769 matches found
Contextual Links validation - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
More info at https://symfony.com/cve-2026-45067...
CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
More info at https://symfony.com/cve-2026-45755...
CVE-2026-45753: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
More info at https://symfony.com/cve-2026-45753...
CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
More info at https://symfony.com/cve-2026-45065...
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
More info at https://www.drupal.org/sa-core-2019-012...
Guard bypass in Eloquent models
More info at https://blog.laravel.com/security-release-laravel-61834-7232...
Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
More info at https://symfony.com/cve-2026-48784...
Contextual Links validation - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
More info at https://www.drupal.org/sa-core-2019-009...
Content moderation - Moderately critical - Access bypass
More info at https://www.drupal.org/sa-core-2018-006...
Prevent installation typosquatting malware
More info at https://www.kernelmode.blog/typosquatting-malware-found-in-composer-repository/...
CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
More info at https://symfony.com/cve-2026-45064...
CVE-2026-54717 - XSS in breadcrumbs in page list view
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54717...
Credentials disclosure in the crawler
More info at https://contao.org/en/security-advisories/credentials-disclosure-in-the-crawler...
Regression in Query Parenthesis can have Security Implications
Return insensitive check after 8453 Problem: -andWhere"u.name = ?1 or u.username = ?1"; did not wrap part in parenthesis when or or and was written in lowercase anymore. It still worked for uppercase OR and AND. Fixes 8595...
Potentially sensitive data exposure
Description Impact Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish, messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch does not succeed. The dispatch method can be considered to...
EZSA-2020-004 Object Injection in SiteAccessMatchListener
More info at https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener...
Insecure default secret key and IV allowing anyone to decrypt values
This issue has been deleted...
XSS vulnerability in blade templating
More info at https://github.com/laravel/framework/pull/31945...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
EZSA-2019-007 Prevent accepting app.php in URL in Platform.sh
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-007-prevent-accepting-app.php-in-url-in-platform.sh...
Vulnerability to bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
EZSA-2019-002 Password reset vulnerability
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability...
Cross-Site Scripting in Fluid ViewHelpers
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...
Broken Access Control in Localization Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
SS-2018-019: Possible denial of service attack vector when flushing
More info at https://www.silverstripe.org/download/security-releases/ss-2018-019/...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
SS-2018-007: CSRF vulnerability in graphql
More info at https://www.silverstripe.org/download/security-releases/ss-2018-007/...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
EZSA-2018-008 REST API returns list of all SiteAccesses
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses...
EZSA-2018-006 XSS vulnerability in 'disabled module' error template
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template...
SS-2018-018: Database credentials disclosure during connection failure
More info at https://www.silverstripe.org/download/security-releases/ss-2018-018/...
SUPEE-10752 - Multiple security enhancements vulnerabilities
More info at https://magento.com/security/patches/supee-10752...
SS-2018-011: SQL injection vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2018-011/...
SS-2017-007: CSV Excel Macro Injection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...
SS-2017-006: Session user agent change detection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...
Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/...
Cookie leakage to wrong origins and non-restricted cookie acceptance
Security and maintenance release. - Security: Previously cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax follows newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, b...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...