1769 matches found
CVE-2026-55779 - XSS in archive admin restore
More info at https://www.silverstripe.org/download/security-releases/cve-2026-55779...
Path traversal in the jobs module
More info at https://contao.org/en/security-advisories/path-traversal-in-the-jobs-module...
Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
More info at https://www.drupal.org/sa-core-2020-003...
Arbitrary Code Execution via File List Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-008...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Denial of service
Make the world a bit safer...
Information Disclosure in Install Tool
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...
Security Misconfiguration in Install Tool Cookie
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
XSS in class documenting_xmlrpc_server
More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...
SS-2017-005: User enumeration via timing attack on login and password reset forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...
SS-2017-003: XSS in RedirectorPage
More info at https://www.silverstripe.org/download/security-releases/ss-2017-003/...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-014/...
SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers
More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
User authentication bypass
More info at https://thelia.net/version-2-1-3-with-security-fix...
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010
More info at https://www.drupal.org/sa-core-2019-010...
Exploit of encryption failure vulnerability
More info at https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
More info at https://symfony.com/cve-2026-45071...
SS-2018-015: Vulnerable dependency
More info at https://www.silverstripe.org/download/security-releases/ss-2018-015/...
Anonymous Open Redirect - Moderately Critical - Open Redirect
More info at https://www.drupal.org/sa-core-2018-006...
The `spaceless` filter implicitly marks its output as safe
More info at https://symfony.com/cve-2026-46628...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
More info at https://symfony.com/cve-2026-47212...
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
More info at https://symfony.com/cve-2026-45072...
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
More info at https://symfony.com/cve-2026-45073...
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
More info at https://symfony.com/cve-2026-46637...
Possible sandbox bypass when using a source policy
More info at https://symfony.com/cve-2026-24425...
TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020...
TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
Custom action dispatcher bypasses access_control on other routes
More info at https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h...
Fixes redirect uri validation in oauth
More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...
E-mail HTML injection
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Cross-Site Scripting in Frontend User Login
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
EZSA-2018-007 User data disclosure
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...
EZSA-2018-009 Do not interpret PHP/PHAR uploads
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads...
EZSA-2018-005 Passwordless login for LDAP users
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users...
Magento 2.2.5 and 2.1.14 Security update
More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...
SS-2018-004: XSS Vulnerability via WYSIWYG editor
More info at https://www.silverstripe.org/download/security-releases/ss-2018-004/...
EZSA-2017-006 Information disclosure in backend content tree menu
More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
SS-2016-006: Missing CSRF protection in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2016-006/...
Incorrect CSRF validation
More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
Fixes a security issue where the session could be hijacked
Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...