XSS in class documenting_xmlrpc_server

More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...

EZSA-2017-006 Information disclosure in backend content tree menu

More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu...

SS-2017-003: XSS in RedirectorPage

More info at https://www.silverstripe.org/download/security-releases/ss-2017-003/...

SUPEE-9652 - Remote Code Execution using mail vulnerability

More info at https://magento.com/security/patches/supee-9652...

Cross-Site Scripting in TYPO3 Backend

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-014/...

Missing Access Check in TYPO3 CMS

More info at https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms/...

SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers

More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...

SS-2015-026: Form field validation message XSS vulnerability

More info at https://www.silverstripe.org/download/security-releases/ss-2015-026/...

Denial of Service attack through XML payloads

More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...

SS-2015-010: XSS in Director::force_redirect()

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect/...

Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer

More info at https://framework.zend.com/security/advisory/ZF2014-02...

Fixes a security issue where the session could be hijacked

Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...

Potential XSS vector in Zend_Dojo_View_Helper_Editor

More info at https://framework.zend.com/security/advisory/ZF2010-02...

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-918: Server-Side Request Forgery SSRF CVSS vector v.3.1: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS vector v.4.0: 8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description: SSRF occurs when a processed HTML document is read and...

CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

More info at https://symfony.com/cve-2026-45068...

CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

More info at https://symfony.com/cve-2026-45071...

Reflected Cross-Site-Scripting

More info at https://simplesamlphp.org/security/201907-01...

CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

More info at https://symfony.com/cve-2026-47212...

CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

More info at https://symfony.com/cve-2026-45068...

CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

More info at https://symfony.com/cve-2026-45073...

CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering

More info at https://symfony.com/cve-2026-45072...

HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

More info at https://symfony.com/cve-2026-46637...

OS Command injection

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

Server-side request forgery (SSRF) via unvalidated RSS feed URLs

More info at https://contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls...

Path traversal in the jobs module

More info at https://contao.org/en/security-advisories/path-traversal-in-the-jobs-module...

Fixes redirect uri validation in oauth

More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...

EZSA-2019-004 CSRF token in login form is disabled by default

More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default...

E-mail HTML injection

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

Security Misconfiguration for Backend User Accounts

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...

Security Misconfiguration in Install Tool Cookie

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...

Denial of Service in Online Media Asset Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...

Magento 2.2.5 and 2.1.14 Security update

More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...

SS-2018-010: Member disclosure in login form

More info at https://www.silverstripe.org/download/security-releases/ss-2018-010/...

SS-2018-004: XSS Vulnerability via WYSIWYG editor

More info at https://www.silverstripe.org/download/security-releases/ss-2018-004/...

Remote Code Execution Vulnerability

More info at https://community.shopware.com/detail1989.html...

SS-2016-006: Missing CSRF protection in login form

More info at https://www.silverstripe.org/download/security-releases/ss-2016-006/...

Incorrect CSRF validation

More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...

User authentication bypass

More info at https://thelia.net/version-2-1-3-with-security-fix...

CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass

More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...

CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS

More info at https://symfony.com/cve-2026-45756...

Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010

More info at https://www.drupal.org/sa-core-2019-010...

Exploit of encryption failure vulnerability

More info at https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0...

CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator

More info at https://symfony.com/cve-2026-45063...

Anonymous Open Redirect - Moderately Critical - Open Redirect

More info at https://www.drupal.org/sa-core-2018-006...

Drupal core - Moderately critical - Denial of Service

More info at https://www.drupal.org/sa-core-2024-001...

CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator

More info at https://symfony.com/cve-2026-45063...

CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection

More info at https://symfony.com/cve-2026-45754...

CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass

More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...

Custom action dispatcher bypasses access_control on other routes

More info at https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h...

CVE-2026-55779 - XSS in archive admin restore

More info at https://www.silverstripe.org/download/security-releases/cve-2026-55779...