1717 matches found
Incorrect Ed25519 public key validation
!NOTE The fix was released in v2.5.1 Reported by Arpit Jain @arpitjain099 via email. This validation gate misfires, allowing invalid public keys to be loaded. Full advisory: https://github.com/paragonie/sodiumcompat/security/advisories/GHSA-733q-f2wq-9c8w The actual downstream impact is minimal i...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...
Custom action dispatcher bypasses access_control on other routes
More info at https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h...
OS Command injection
Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...
Arbitrary code execution
Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...
Arbitrary code execution
More info at https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28...
TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-020...
Server-side request forgery (SSRF) via unvalidated RSS feed URLs
More info at https://contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls...
Server-side request forgery (SSRF) via unvalidated RSS feed URLs
More info at https://contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls...
CVE-2026-54718 - Remote code execution via advanced workflow email template
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54718...
CVE-2026-54721 - Remote code execution via userforms email subject
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54721...
CVE-2026-55779 - XSS in archive admin restore
More info at https://www.silverstripe.org/download/security-releases/cve-2026-55779...
CVE-2026-54720 - XSS attack through media embed
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54720...
CVE-2026-54717 - XSS in breadcrumbs in page list view
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54717...
symfony/ux-toolkit Path Traversal allows arbitrary file write and read via crafted recipe manifest
Description The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative, which returns true for paths like ../../../etc. Path::join then resolves the .. segments without complaint, so the...
symfony/ux-icons XSS via unsanitized SVG content in local files and Iconify on-demand responses
Description The uxicon Twig function is marked issafe='html', so Twig never escapes its output. Icon::toHtml inlines the SVG source verbatim into the page. Browsers execute elements and on event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site...
Dot-only cookie domains match all hosts
Impact CookieJar incorrectly accepts cookies with a dot-only Domain attribute, such as Domain=., Domain=.., Domain=..., and whitespace-padded variants such as Domain= . . In affected versions, SetCookie::matchesDomain removes leading dots from the cookie domain, normalizing dot-only values to the...
Silent HTTPS proxy downgrade to cleartext
Impact The built-in cURL handlers GuzzleHttp\Handler\CurlHandler and GuzzleHttp\Handler\CurlMultiHandler, used by default whenever the PHP cURL extension is available accept an https:// proxy — a proxy reached over a TLS-encrypted connection — through the proxy request option, client-level proxy...
CRLF injection in HTTP start-line serialization
Impact guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x...
Credentials disclosure in the crawler
More info at https://contao.org/en/security-advisories/credentials-disclosure-in-the-crawler...
Path traversal in the jobs module
More info at https://contao.org/en/security-advisories/path-traversal-in-the-jobs-module...
Path traversal in the jobs module
More info at https://contao.org/en/security-advisories/path-traversal-in-the-jobs-module...
Credentials disclosure in the crawler
More info at https://contao.org/en/security-advisories/credentials-disclosure-in-the-crawler...
CompilerRuntime code injection via unescaped function names
Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...
TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-019...
TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-018...
TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-017...
TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-016...
TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-015...
TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-014...
TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-013...
TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-012...
TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-011...
TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-010...
TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-009...
TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-008...
TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-007...
TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...
TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...
JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Summary JWSVerifier::getAlgorithm in src/Library/Signature/JWSVerifier.php line 144 merges protected and unprotected headers using PHP's spread operator: php $completeHeader = ...$signature-getProtectedHeader, ...$signature-getHeader; In PHP, when spreading arrays with duplicate string keys, the...
JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Summary JWSVerifier::getAlgorithm in src/Library/Signature/JWSVerifier.php line 144 merges protected and unprotected headers using PHP's spread operator: php $completeHeader = ...$signature-getProtectedHeader, ...$signature-getHeader; In PHP, when spreading arrays with duplicate string keys, the...
RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
Impact RSACrypt::decryptWithRSA15 used by the RSA15 key-encryption algorithm implements RSAES-PKCS1-v15 decryption by inspecting the padding after RSADP and throwing InvalidArgumentException as soon as the padding is malformed. It does not implement the implicit-rejection countermeasure required ...
RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
Impact RSACrypt::decryptWithRSA15 used by the RSA15 key-encryption algorithm implements RSAES-PKCS1-v15 decryption by inspecting the padding after RSADP and throwing InvalidArgumentException as soon as the padding is malformed. It does not implement the implicit-rejection countermeasure required ...
Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Impact The experimental Chacha20Poly1305 key-encryption algorithm generates the 16-byte Poly1305 authentication tag during encryptKey but discards it: the tag is never written to the header and therefore never reaches the wire. On the receiving side, decryptKey calls...
Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Impact The experimental Chacha20Poly1305 key-encryption algorithm generates the 16-byte Poly1305 authentication tag during encryptKey but discards it: the tag is never written to the header and therefore never reaches the wire. On the receiving side, decryptKey calls...
PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Impact When a JWE uses a password-based key-encryption algorithm PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW, PBES2AESKW::unwrapKey reads the p2c PBKDF2 iteration count parameter directly from the attacker-controlled JOSE header and passes it to hashpbkdf2 with no upper bound. The...
PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Impact When a JWE uses a password-based key-encryption algorithm PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW, PBES2AESKW::unwrapKey reads the p2c PBKDF2 iteration count parameter directly from the attacker-controlled JOSE header and passes it to hashpbkdf2 with no upper bound. The...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...