1773 matches found
Cross-site scripting in the Colorbox caption (see GHSA-rr85-7j77-pppg)
More info at https://github.com/contao-components/colorbox/security/advisories/GHSA-rr85-7j77-pppg...
Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)
More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...
Arbitrary code execution
Impact PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey. The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls...
Frontend login Session Fixation
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003/...
A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU
Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...
TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-023...
Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Custom action dispatcher bypasses access_control on other routes
Summary EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute / MenuItem::linkToRoute, swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security...
Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http
More info at https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj...
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...
Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...
Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...
TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014...
Plaintext credentials written to the threat log and readable by any authenticated user
More info at https://github.com/jay123anta/laravel-threat-detection/security/advisories/GHSA-9jh8-pj82-6ccg...
Marking a detection as a false positive could create a wider exclusion rule than intended
More info at https://github.com/jay123anta/laravel-threat-detection/security/advisories/GHSA-rppj-hxxm-v5pr...