1773 matches found
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-014/...
SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers
More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
User authentication bypass
More info at https://thelia.net/version-2-1-3-with-security-fix...
Drupal core - Moderately critical - Denial of Service
More info at https://www.drupal.org/sa-core-2024-001...
Reflected Cross-Site-Scripting
More info at https://simplesamlphp.org/security/201907-01...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...
TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...
Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
Custom action dispatcher bypasses access_control on other routes
More info at https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h...
Arbitrary code execution
Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...
EZSA-2019-004 CSRF token in login form is disabled by default
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default...
EZSA-2019-002 Password reset vulnerability
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability...
EZSA-2019-001 XSS in Admin UI
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui...
Cross-Site Scripting in Frontend User Login
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...
EZSA-2018-007 User data disclosure
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...
EZSA-2018-009 Do not interpret PHP/PHAR uploads
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads...
EZSA-2018-005 Passwordless login for LDAP users
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users...
SS-2018-010: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2018-010/...
Fixes a security issue where the session could be hijacked
Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...
Exploit of encryption failure vulnerability
More info at https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0...
SS-2018-015: Vulnerable dependency
More info at https://www.silverstripe.org/download/security-releases/ss-2018-015/...
TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018...
TYPO3-EXT-SA-2026-022: Server-Side Template Injection in extension "powermail" (powermail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022...
TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027...
TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...
TYPO3-EXT-SA-2026-016: Information Disclosure in extension "Modules" (modules)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016...
TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...
SS-2016-006: Missing CSRF protection in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2016-006/...
SS-2016-011: ChangePasswordForm does not check Member::canLogIn()
More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...
XSS vulnerability in login redirect param
Security advisory: XSS vulnerability in login redirect param ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in 4a00966 Affected versions All versions below 1.15.2 are affected. dev-master is fixed starting from 4a00966 Exploits...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-022...
TYPO3-EXT-SA-2026-023: Broken Access Control in extension "Event management and registration" (sf_event_mgt)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...
TYPO3-EXT-SA-2026-015: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...