PHP package security
PHP package vulnerabilities
Known security advisories for popular PHP and Laravel packages. Each page lists the affected versions, the version that fixes each issue, and lets you check the version you run.
Latest advisories
| Reported | Package | Advisory | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-28 | symfony/symfony | CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter NamesCVE-2026-45070 | medium | 7.4.22, 8.1.0, 8.1.10 and 17 older lines |
| 2026-10-28 | silverstripe/framework | SS-2026-004 - Password reset token account takeover | unscored | 6.2.13 |
| 2026-10-28 | silverstripe/framework | CVE-2026-88987 - XSS via XHTML data URICVE-2026-88987 | unscored | 6.2.13 |
| 2026-10-27 | phpoffice/phpspreadsheet | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingCVE-2026-108360 | medium | not stated |
| 2026-10-27 | phpoffice/phpspreadsheet | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)CVE-2026-108359 | high | not stated |
| 2026-10-27 | phpunit/phpunit | PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingCVE-2026-119193 | medium | 13.4.4 |
| 2026-10-23 | laravel/framework | Laravel TokenGuard authentication bypass through non-string API credentialsCVE-2026-114509 | critical | 12.68.0, 13.29.0 |
| 2026-10-23 | laravel/framework | Laravel relationship inclusion can trigger unauthorized data destructionCVE-2026-114508 | medium | 12.68.0, 13.27.0 |
| 2026-10-23 | livewire/livewire | Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order | medium | 4.4.8 |
| 2026-10-14 | symfony/symfony | CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessCVE-2026-109449 | unscored | 7.4.21, 8.1.0, 8.1.9 and 17 older lines |
| 2026-10-05 | filament/filament | Filament: Multi-factor authentication (app) management actions do not require password reauthenticationCVE-2026-104181 | medium | not stated |
| 2026-09-30 | league/commonmark | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal | medium | not stated |
| 2026-09-30 | league/commonmark | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan | high | not stated |
| 2026-09-29 | league/flysystem | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterCVE-2026-102601 | low | not stated |
| 2026-09-17 | cakephp/cakephp | CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionCVE-2026-79752 | critical | 5.1.9, 5.2.14, 5.3.7 and 2 older lines |
All packages, most recent advisory first
| Package | Advisories | Latest advisory | Newest release |
|---|---|---|---|
| symfony/symfony | 107 | 2026-10-28 | 8.1.10 |
| silverstripe/framework | 103 | 2026-10-28 | 6.3.2 |
| phpoffice/phpspreadsheet | 35 | 2026-10-27 | 5.10.0 |
| phpunit/phpunit | 5 | 2026-10-27 | 13.4.6 |
| laravel/framework | 30 | 2026-10-23 | 13.40.0 |
| livewire/livewire | 6 | 2026-10-23 | 4.4.8 |
| filament/filament | 8 | 2026-10-05 | 5.11.1 |
| league/commonmark | 18 | 2026-09-30 | 2.10.7 |
| league/flysystem | 2 | 2026-09-29 | 3.36.0 |
| cakephp/cakephp | 22 | 2026-09-17 | 5.4.4 |
| symfony/http-foundation | 15 | 2026-09-15 | 8.1.10 |
| october/system | 25 | 2026-09-14 | 1.1.12 |
| pimcore/pimcore | 136 | 2026-09-10 | 2026.3.4 |
| phpseclib/phpseclib | 11 | 2026-09-08 | 4.0.3 |
| predis/predis | 1 | 2026-09-08 | 3.7.1 |
| maatwebsite/excel | 1 | 2026-09-08 | 4.0.6 |
| smarty/smarty | 18 | 2026-09-01 | 5.8.5 |
| symfony/yaml | 6 | 2026-08-30 | 8.1.10 |
| backpack/crud | 11 | 2026-08-20 | 7.1.24 |
| typo3/cms-core | 130 | 2026-08-11 | 14.3.10 |
| codeigniter4/framework | 19 | 2026-08-07 | 4.7.6 |
| craftcms/cms | 127 | 2026-08-07 | 5.12.0 |
| statamic/cms | 44 | 2026-08-06 | 6.40.0 |
| guzzlehttp/guzzle | 15 | 2026-08-03 | 8.3.1 |
| dompdf/dompdf | 20 | 2026-07-22 | 3.1.6 |
| guzzlehttp/psr7 | 6 | 2026-07-21 | 3.2.0 |
| twig/twig | 26 | 2026-07-01 | 3.30.0 |
| shopware/core | 65 | 2026-06-04 | 6.7.16.0 |
| spatie/laravel-medialibrary | 2 | 2026-05-29 | 11.23.11 |
| symfony/http-client | 2 | 2026-05-26 | 8.1.10 |
| symfony/routing | 4 | 2026-05-26 | 8.1.10 |
| symfony/security-http | 20 | 2026-05-26 | 8.1.10 |
| drupal/core | 112 | 2026-05-20 | 11.4.11 |
| symfony/http-kernel | 8 | 2026-05-20 | 8.1.10 |
| symfony/mailer | 1 | 2026-05-20 | 8.1.10 |
| symfony/twig-bridge | 2 | 2026-05-20 | 8.1.10 |
| yiisoft/yii2 | 13 | 2026-05-11 | 2.0.55 |
| laravel/passport | 1 | 2026-04-08 | 13.10.0 |
| aws/aws-sdk-php | 4 | 2026-03-27 | 3.402.5 |
| symfony/process | 2 | 2026-01-28 | 8.1.10 |
| magento/community-edition | 361 | 2025-10-14 | 2.4.9 |
| firebase/php-jwt | 3 | 2025-07-31 | 7.2.1 |
| spatie/browsershot | 10 | 2025-04-04 | 5.4.2 |
| phpmyadmin/phpmyadmin | 107 | 2025-01-23 | 5.2.3 |
| nesbot/carbon | 1 | 2025-01-08 | 3.15.1 |
| tecnickcom/tcpdf | 8 | 2024-12-27 | 7.0.21 |
| unisharp/laravel-filemanager | 3 | 2024-12-18 | 2.15.1 |
| laravel/pulse | 1 | 2024-12-13 | 1.8.1 |
| phpmailer/phpmailer | 14 | 2024-02-02 | 7.1.1 |
| league/oauth2-server | 1 | 2023-07-06 | 9.4.1 |
| laminas/laminas-diactoros | 2 | 2023-04-24 | 3.9.0 |
| ezyang/htmlpurifier | 4 | 2022-05-17 | 4.19.1 |
| mpdf/mpdf | 1 | 2022-05-14 | 8.3.1 |
| laravel/fortify | 1 | 2022-02-23 | 1.41.0 |
| facade/ignition | 3 | 2021-11-19 | 2.17.7 |
| doctrine/dbal | 2 | 2021-11-11 | 4.5.0 |
| lcobucci/jwt | 1 | 2021-09-28 | 5.6.1 |
| laminas/laminas-http | 1 | 2021-06-08 | 2.23.0 |
| wp-cli/wp-cli | 1 | 2021-05-14 | 2.12.0 |
| symfony/security-core | 5 | 2021-05-12 | 8.1.10 |
| doctrine/orm | 3 | 2021-04-06 | 3.7.6 |
| swiftmailer/swiftmailerabandoned | 3 | 2020-12-08 | 6.3.0 |
| laravel/socialite | 2 | 2015-08-03 | 5.31.0 |
| monolog/monolog | 1 | 2014-12-29 | 3.12.1 |
| barryvdh/laravel-dompdf | 0 | none on record | 3.1.2 |
| inertiajs/inertia-laravel | 0 | none on record | 3.7.0 |
| intervention/image | 0 | none on record | 4.4.1 |
| laravel/cashier | 0 | none on record | 16.9.0 |
| laravel/horizon | 0 | none on record | 5.50.1 |
| laravel/jetstream | 0 | none on record | 5.5.3 |
| laravel/sanctum | 0 | none on record | 4.3.3 |
| laravel/telescope | 0 | none on record | 5.27.0 |
| spatie/laravel-permission | 0 | none on record | 8.3.2 |
Check your whole project at once. Paste or upload composer.lock and see which installed packages have known advisories. Processed in memory, never stored.
Check composer.lockQuestions
Where does this advisory data come from?
From the Packagist security advisories API. Packagist collects advisories from the GitHub Advisory Database and the FriendsOfPHP security advisories repository. It is the same data composer audit uses.
How do I check every package in my project at once?
Run composer audit in the project folder, or paste your composer.lock into the free Composer vulnerability checker on this site. Both compare your installed versions with the known advisories.
A package I use is not listed here. Is it safe?
Not necessarily. This list covers popular packages only. The composer.lock checker looks up every package in your lock file, including ones not listed here.
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fix