PHP package security
Latest PHP package vulnerabilities
Since 4 November 2025, 305 CVEs have been published for 40 of the popular PHP and Laravel packages we track. 113 of them are rated critical or high, and 1 is on CISA's list of vulnerabilities exploited in the wild. Each one links to a page with the affected and fixed versions and the Composer steps to fix it.
- CVEs since 4 November 2025
- 305
- Critical
- 16
- High
- 97
- Medium
- 155
- Low or unscored
- 37
- Exploited in the wild
- 1
Which packages had the most CVEs?
| Package | CVEs since 4 November 2025 |
|---|---|
| craftcms/cms | 71 |
| statamic/cms | 34 |
| symfony/symfony | 17 |
| twig/twig | 17 |
| pimcore/pimcore | 16 |
| typo3/cms-core | 15 |
| phpoffice/phpspreadsheet | 13 |
| shopware/core | 13 |
| backpack/crud | 9 |
| october/system | 9 |
October 2026 · 11 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-29 | CVE-2026-119193PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling | phpunit/phpunit | medium | 13.4.4 |
| 2026-10-22 | CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | phpoffice/phpspreadsheet | medium | not stated |
| 2026-10-22 | CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | phpoffice/phpspreadsheet | high | not stated |
| 2026-10-22 | CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | phpoffice/phpspreadsheet | high | not stated |
| 2026-10-22 | CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | phpoffice/phpspreadsheet | high | not stated |
| 2026-10-21 | CVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentials | laravel/framework | critical | 12.68.0, 13.29.0 |
| 2026-10-21 | CVE-2026-114508Laravel relationship inclusion can trigger unauthorized data destruction | laravel/framework | medium | 12.68.0, 13.27.0 |
| 2026-10-15 | CVE-2026-109449Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process | symfony/symfony | high | 6.4.48, 7.4.21, 8.1.9 and 1 older lines |
| 2026-10-15 | CVE-2026-109413Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | symfony/yaml | high | 6.4.45, 7.4.18, 8.1.6 and 1 older lines |
| 2026-10-15 | CVE-2026-108082ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | symfony/http-foundation | high | 6.4.46, 7.4.19, 8.1.7 and 1 older lines |
| 2026-10-01 | CVE-2026-104181Filament: Multi-factor authentication (app) management actions do not require password reauthentication | filament/filament | medium | not stated |
September 2026 · 22 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-09-29 | CVE-2026-102601Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path… | league/flysystem | low | not stated |
| 2026-09-28 | CVE-2026-102279Laravel: XSS in Debug Page Information | laravel/framework | low | 12.69.0, 13.30.0 |
| 2026-09-17 | CVE-2026-79752CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection | cakephp/cakephp | critical | 5.1.9, 5.2.14, 5.3.7 and 2 older lines |
| 2026-09-14 | CVE-2026-57570Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation | backpack/crud | medium | 6.8.15, 7.0.47 |
| 2026-09-14 | CVE-2026-55416Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | pimcore/pimcore | high | 11.5.18 |
| 2026-09-14 | CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | pimcore/pimcore | high | 12.3.9 |
| 2026-09-14 | CVE-2026-54182Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | backpack/crud | high | 5.6.2, 6.8.13, 7.0.36 and 1 older lines |
| 2026-09-14 | CVE-2026-54181Laravel Backpack CRUD: Stored XSS in the color column — the @if($column['escaped']) branches are inverted | backpack/crud | medium | 6.8.14, 7.0.38 |
| 2026-09-14 | CVE-2026-54180Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | backpack/crud | high | 6.8.14, 7.0.38 |
| 2026-09-14 | CVE-2026-54178Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | backpack/crud | high | 6.8.12, 7.0.35 |
| 2026-09-14 | CVE-2026-54177Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of shell.php reach the webserver | backpack/crud | medium | 6.8.14, 7.0.38 |
| 2026-09-14 | CVE-2026-54176Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check | backpack/crud | medium | 6.8.14, 7.0.38 |
| 2026-09-14 | CVE-2026-54175Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment | backpack/crud | high | 6.8.11, 7.0.34 |
| 2026-09-14 | CVE-2026-49400October CMS: PHP Object Injection via Backend Widget Session Storage | october/system | low | 3.7.17, 4.2.23 |
| 2026-09-14 | CVE-2026-46696October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls | october/system | low | 3.7.17, 4.2.23 |
| 2026-09-04 | CVE-2026-48019Laravel CRLF injection in default email rule | laravel/framework | high | 12.60.0, 13.10.0 |
| 2026-09-04 | CVE-2026-46636Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders | twig/twig | high | 3.27.0 |
| 2026-09-01 | CVE-2026-84374Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path | maatwebsite/excel | high | 3.1.70 |
| 2026-09-01 | CVE-2026-84372Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | predis/predis | critical | 3.3.0 |
| 2026-09-01 | CVE-2026-84308Phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery | phpseclib/phpseclib | medium | 3.0.57, 4.0.1 |
| 2026-09-01 | CVE-2026-84307Filament: Password validity disclosure for accounts denied panel access on login page | filament/filament | low | 4.12.5, 5.7.5 |
| 2026-09-01 | CVE-2026-84306Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used | filament/filament | medium | 4.12.6, 5.7.6 |
August 2026 · 32 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-08-31 | CVE-2026-81887Livewire DOM-based cross-site scripting during client-side state handling | livewire/livewire | medium | not stated |
| 2026-08-31 | CVE-2026-62993Smarty: SSRF via redirect bypass of trusted_uri using {fetch} | smarty/smarty | medium | 4.5.7, 5.8.2 |
| 2026-08-31 | CVE-2026-54179Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a data:image prefix — SVG-with-script lands on the public disk | backpack/crud | medium | 6.8.14, 7.0.38 |
| 2026-08-28 | CVE-2026-55634Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | pimcore/pimcore | critical | not stated |
| 2026-08-28 | CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | pimcore/pimcore | critical | not stated |
| 2026-08-24 | CVE-2026-77635CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver | cakephp/cakephp | critical | 5.1.10, 5.2.15, 5.3.7 |
| 2026-08-24 | CVE-2026-77634CakePHP: SmtpTransport vulnerable to CRLF header injection | cakephp/cakephp | high | 5.1.8, 5.2.14, 5.3.7 and 2 older lines |
| 2026-08-24 | CVE-2026-77567Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled | filament/filament | high | 4.12.0, 5.7.0 |
| 2026-08-11 | CVE-2026-72785Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | craftcms/cms | medium | 5.10.6 |
| 2026-08-11 | CVE-2026-72783Craft CMS: Incorrect path validation could potentially lead to path traversal | craftcms/cms | low | 4.18.2, 5.10.6 |
| 2026-08-11 | CVE-2026-72782Craft CMS: Authenticated leak of secret environment variables | craftcms/cms | medium | 4.18.2, 5.10.6 |
| 2026-08-11 | CVE-2026-72781Craft CMS: Authenticated RCE through Twig sandbox escape | craftcms/cms | high | 4.18.3, 5.10.7 |
| 2026-08-11 | CVE-2026-72779Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts | craftcms/cms | medium | 4.18.2, 5.10.6 |
| 2026-08-11 | CVE-2026-72778Craft CMS: Authenticated RCE via condition.config JSON cleanse bypass | craftcms/cms | high | 4.18.2, 5.10.6 |
| 2026-08-11 | CVE-2026-19418TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool | typo3/cms-core | high | 13.4.34, 14.3.6 |
| 2026-08-07 | CVE-2026-62996Smarty Security stream restriction bypass through stream: resource | smarty/smarty | medium | 5.8.4 |
| 2026-08-07 | CVE-2026-62992Smarty: Symlink path traversal out of trusted directories | smarty/smarty | medium | 4.5.7, 5.8.2 |
| 2026-08-06 | CVE-2026-71488League/commonmark: Quadratic-time denial of service when parsing crafted Markdown | league/commonmark | high | 2.9.0 |
| 2026-08-06 | CVE-2026-71478League/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | league/commonmark | medium | not stated |
| 2026-08-06 | CVE-2026-71435Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template | statamic/cms | medium | 5.74.3, 6.24.2 |
| 2026-08-06 | CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types | statamic/cms | medium | 5.74.3, 6.24.2 |
| 2026-08-06 | CVE-2026-64665Statamic: Account takeover via OAuth email matching without email-verification check | statamic/cms | high | 5.74.1, 6.24.0 |
| 2026-08-06 | CVE-2026-64664Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | statamic/cms | medium | 5.74.1, 6.24.0 |
| 2026-08-06 | CVE-2026-64663Statamic: Unsafe method invocation via Antlers template resolution allows data destruction | statamic/cms | medium | 5.74.1, 6.24.0 |
| 2026-08-06 | CVE-2026-64662Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | statamic/cms | medium | 5.74.1, 6.24.0 |
| 2026-08-05 | CVE-2026-71293Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | statamic/cms | medium | not stated |
| 2026-08-03 | CVE-2026-69246Guzzle: Noncanonical host can bypass host-based checks | guzzlehttp/guzzle | high | 7.15.2, 8.0.1 |
| 2026-08-03 | CVE-2026-69245Guzzle: Noncanonical cookie domain keeps subdomain scope | guzzlehttp/guzzle | medium | 7.15.2, 8.0.1 |
| 2026-08-01 | CVE-2026-67355Guzzle: Host-only cookie scope is not preserved | guzzlehttp/guzzle | medium | 7.15.1 |
| 2026-08-01 | CVE-2026-67354Guzzle: URI fragments disclosed in redirect Referer headers | guzzlehttp/guzzle | medium | 7.15.1 |
| 2026-08-01 | CVE-2026-67353Guzzle: Unbounded response cookies risk denial of service | guzzlehttp/guzzle | medium | 7.15.1 |
| 2026-08-01 | CVE-2026-67339Guzzle: Proxy-Authorization headers can be sent to origin servers | guzzlehttp/guzzle | medium | 7.14.2 |
July 2026 · 90 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-07-31 | CVE-2026-63223CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules | codeigniter4/framework | critical | 4.7.4 |
| 2026-07-31 | CVE-2026-63222CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames | codeigniter4/framework | high | 4.7.4 |
| 2026-07-31 | CVE-2026-63221CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions | codeigniter4/framework | critical | 4.7.4 |
| 2026-07-31 | CVE-2026-63220CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() | codeigniter4/framework | medium | 4.7.4 |
| 2026-07-28 | CVE-2026-59943Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem | dompdf/dompdf | medium | 3.1.6 |
| 2026-07-28 | CVE-2026-59942Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps | dompdf/dompdf | medium | 3.1.6 |
| 2026-07-28 | CVE-2026-59941Dompdf: Uncontrolled resource consumption based on declared BMP dimensions | dompdf/dompdf | medium | 3.1.6 |
| 2026-07-28 | CVE-2026-59933PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | phpoffice/phpspreadsheet | high | not stated |
| 2026-07-28 | CVE-2026-59932PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | phpoffice/phpspreadsheet | high | not stated |
| 2026-07-28 | CVE-2026-59931PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | phpoffice/phpspreadsheet | high | not stated |
| 2026-07-28 | CVE-2026-56722Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | dompdf/dompdf | medium | 3.1.6 |
| 2026-07-28 | CVE-2026-55555Dompdf: File existence oracle via font-face stylesheet declaration | dompdf/dompdf | low | 3.1.6 |
| 2026-07-28 | CVE-2026-55554Dompdf: Chroot Validation Bypass | dompdf/dompdf | low | 3.1.6 |
| 2026-07-23 | CVE-2026-48013Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | shopware/core | medium | 6.7.10.1 |
| 2026-07-23 | CVE-2026-48012Shopware SSO referer trust leading to an arbitrary redirect target | shopware/core | medium | 6.7.10.1 |
| 2026-07-17 | CVE-2026-54244Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors | statamic/cms | low | 5.74.0, 6.20.3 |
| 2026-07-17 | CVE-2026-54243Statamic Vulnerable to CSV formula injection in form submission exports | statamic/cms | medium | 5.73.24, 6.20.1 |
| 2026-07-17 | CVE-2026-54242Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | statamic/cms | medium | 5.73.24, 6.20.1 |
| 2026-07-17 | CVE-2026-48062CodeIgniter4 has a validation bypass when uploading file extensions via ext_in rule | codeigniter4/framework | critical | 4.7.2 |
| 2026-07-17 | CVE-2026-48016Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-48015Shopware: Stored XSS via SVG file upload — no SVG sanitization | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-48014Shopware: Admin API ACL Bypass in Order State Transition Endpoints | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-48010Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-48009Shopware: Admin Account Takeover via User Recovery Hash Exposure | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-48008Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass | shopware/core | medium | 6.6.10.18, 6.7.10.1 |
| 2026-07-17 | CVE-2026-45704Pimcore has a CustomReports Share Bypass | pimcore/pimcore | high | 2026.1.2 |
| 2026-07-17 | CVE-2026-45703Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | pimcore/pimcore | medium | 2026.1.3 |
| 2026-07-17 | CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | pimcore/pimcore | high | 2026.1.3 |
| 2026-07-17 | CVE-2026-45162Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction | pimcore/pimcore | high | 2026.1.3 |
| 2026-07-17 | CVE-2026-44739Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration | pimcore/pimcore | high | 2026.1.2 |
| 2026-07-14 | CVE-2026-49981Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached Template | twig/twig | high | not stated |
| 2026-07-14 | CVE-2026-48808Sandbox property allowlist bypass via the column filter under SourcePolicyInterface | twig/twig | medium | 3.27.0 |
| 2026-07-14 | CVE-2026-48807Sandbox __toString() policy bypass via Traversable in join/replace and in/not in operators | twig/twig | medium | 3.27.0 |
| 2026-07-14 | CVE-2026-48806Sandbox __toString() policy bypass via dynamic mapping keys | twig/twig | medium | 3.27.0 |
| 2026-07-14 | CVE-2026-48805Sandbox state regression in deprecated internal wrappers in src/Resources/core.php | twig/twig | low | 3.27.0 |
| 2026-07-14 | CVE-2026-48784UrlGenerator Dot-Segment Encoding Skips Every Other Chained ../ or ./ → Generated URL Collapses Off-Route Under RFC 3986 Normalization | symfony/routing | medium | 6.4.41, 7.4.13, 8.0.13 and 1 older lines |
| 2026-07-14 | CVE-2026-48761HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta… | symfony/symfony | medium | 6.4.41, 7.4.13, 8.0.13 |
| 2026-07-14 | CVE-2026-48760HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense | symfony/symfony | medium | 6.4.41, 7.4.13, 8.0.13 |
| 2026-07-14 | CVE-2026-48747Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | symfony/symfony | medium | 7.4.13, 8.0.13 |
| 2026-07-14 | CVE-2026-48736IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient | symfony/http-client | medium | 5.4.53 |
| 2026-07-14 | CVE-2026-48489Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | symfony/security-http | high | 6.4.41, 7.4.13, 8.0.13 and 1 older lines |
| 2026-07-14 | CVE-2026-47767SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-47732Sandbox: multiple __toString() policy bypasses via unguarded string coercion points | twig/twig | high | 3.26.0 |
| 2026-07-14 | CVE-2026-47730XSS in profiler HtmlDumper via unescaped template and profile names | twig/twig | low | 3.26.0 |
| 2026-07-14 | CVE-2026-47212Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-46640Arbitrary PHP code execution via _self.(<string>) macro-reference compilation | twig/twig | high | 3.26.0 |
| 2026-07-14 | CVE-2026-46639Sandbox property and method bypass via object-destructuring assignment | twig/twig | high | 3.26.0 |
| 2026-07-14 | CVE-2026-46638{% sandbox %}{% include %} skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) | twig/twig | medium | 3.26.0 |
| 2026-07-14 | CVE-2026-46635Sandbox property allowlist bypass via the column filter (array_column on objects) | twig/twig | low | 3.26.0 |
| 2026-07-14 | CVE-2026-46634Template_from_string() escapes a SourcePolicy-driven sandbox via synthesized template name | twig/twig | medium | 3.26.0 |
| 2026-07-14 | CVE-2026-46633PHP code injection via {% use %} template name | twig/twig | critical | 3.26.0 |
| 2026-07-14 | CVE-2026-46628The spaceless filter implicitly marks its output as safe | twig/twig | low | 3.26.0 |
| 2026-07-14 | CVE-2026-46627Sandbox does not protect against resource exhaustion | twig/twig | medium | 3.26.0 |
| 2026-07-14 | CVE-2026-45756JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS | symfony/symfony | low | 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45755Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection | symfony/symfony | medium | 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45754Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45753HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS) | symfony/symfony | low | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45305YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | symfony/yaml | low | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45304YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") | symfony/yaml | low | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45133YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings | symfony/yaml | low | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45077Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | symfony/symfony | high | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45075HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | symfony/http-kernel | high | 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45074Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | symfony/security-http | medium | 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45073SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45072Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering | symfony/twig-bridge | low | 6.4.40 |
| 2026-07-14 | CVE-2026-45071XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | symfony/symfony | low | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45070Email Header Injection via Non-Token Characters in Mime Parameter Names | symfony/symfony | medium | 6.4.49, 7.4.22, 8.1.10 and 1 older lines |
| 2026-07-14 | CVE-2026-45069OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | symfony/security-http | medium | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45068Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | symfony/mailer | medium | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45067Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address | symfony/symfony | high | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45066HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45065UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection | symfony/routing | medium | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-14 | CVE-2026-45064HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | symfony/symfony | medium | 6.4.40, 7.4.12, 8.0.12 |
| 2026-07-14 | CVE-2026-45063Identity Spoofing via Unanchored DN Regex in X509Authenticator | symfony/security-http | high | 6.4.40, 7.4.12, 8.0.12 and 1 older lines |
| 2026-07-08 | CVE-2026-59883Guzzle: Cookie Disclosure and Injection via IP-Address Domains | guzzlehttp/guzzle | medium | 7.12.3 |
| 2026-07-08 | CVE-2026-59882Guzzlehttp/psr7: Host Confusion via Weak URI Host Validation | guzzlehttp/psr7 | medium | 2.12.3 |
| 2026-07-06 | CVE-2026-14794Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics | craftcms/cms | medium | 4.18.1, 5.10.3 |
| 2026-07-06 | CVE-2026-14793Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets | craftcms/cms | medium | 4.18.1, 5.10.3 |
| 2026-07-02 | CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | craftcms/cms | high | 5.10.0 |
| 2026-07-02 | CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File Read | craftcms/cms | medium | 4.18.0, 5.10.0 |
| 2026-07-02 | CVE-2026-55791Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | craftcms/cms | critical | 4.18, 5.10 |
| 2026-07-02 | CVE-2026-50282Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves | craftcms/cms | high | 4.17.14, 5.9.21 |
| 2026-07-02 | CVE-2026-50281Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | craftcms/cms | high | 5.9.21 |
| 2026-07-02 | CVE-2026-50280Craft CMS: Authorization bypass in entries/move-to-section via missing target-section save check | craftcms/cms | medium | 5.9.21 |
| 2026-07-02 | CVE-2026-50279Craft CMS: Authorship spoofing in entries/save-entry via pre-check/post-mutation authorization gap | craftcms/cms | high | 5.9.21 |
| 2026-07-01 | CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table view | craftcms/cms | medium | 5.9.22 |
| 2026-07-01 | CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | craftcms/cms | high | 4.17.15, 5.9.22 |
| 2026-07-01 | CVE-2026-54720XSS attack through media embed | silverstripe/framework | medium | 6.2.2 |
| 2026-07-01 | CVE-2026-50284Craft CMS: Missing peer-permission check in AssetsController::actionDeleteFolder allows deletion of other users' assets | craftcms/cms | high | 4.17.15, 5.9.22 |
| 2026-07-01 | CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | craftcms/cms | medium | 4.17.14, 5.9.21 |
June 2026 · 35 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-06-23 | CVE-2026-55767Dot-only cookie domains match all hosts | guzzlehttp/guzzle | medium | 7.12.1 |
| 2026-06-23 | CVE-2026-55766CRLF injection in HTTP start-line serialization | guzzlehttp/psr7 | medium | 2.12.1 |
| 2026-06-23 | CVE-2026-55568Silent HTTPS proxy downgrade to cleartext | guzzlehttp/guzzle | medium | 7.12.1 |
| 2026-06-22 | CVE-2026-55599Phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority… | phpseclib/phpseclib | medium | not stated |
| 2026-06-22 | CVE-2026-48505Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission | filament/filament | high | 4.11.5, 5.6.5 |
| 2026-06-22 | CVE-2026-48500Filament: Unauthenticated temporary file upload on auth pages | filament/filament | medium | not stated |
| 2026-06-22 | CVE-2026-48166Filament: Timing-based user enumeration on login page | filament/filament | medium | not stated |
| 2026-06-22 | CVE-2026-45034PHPSpreadsheet has a patch bypass for CVE-2026-34084 | phpoffice/phpspreadsheet | critical | not stated |
| 2026-06-21 | CVE-2026-56394Craft CMS has authenticated path traversal in assets/icon, allowing local .svg file read | craftcms/cms | low | not stated |
| 2026-06-21 | CVE-2026-56393Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options | craftcms/cms | low | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-06-21 | CVE-2026-56385Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | craftcms/cms | low | not stated |
| 2026-06-21 | CVE-2026-56384Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | craftcms/cms | medium | not stated |
| 2026-06-21 | CVE-2026-56383Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type | craftcms/cms | low | not stated |
| 2026-06-21 | CVE-2026-56382Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview | craftcms/cms | high | not stated |
| 2026-06-21 | CVE-2026-56381Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page | craftcms/cms | low | not stated |
| 2026-06-19 | CVE-2026-49288Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | statamic/cms | medium | 5.73.23, 6.20.0 |
| 2026-06-19 | CVE-2026-49287Statamic CMS's unsafe method invocation via collection sorting allows data destruction | statamic/cms | high | 5.73.23, 6.20.0 |
| 2026-06-17 | CVE-2026-48820CakePHP: View::element() is missing a path containment check | cakephp/cakephp | medium | 5.1.7, 5.2.13, 5.3.6 and 2 older lines |
| 2026-06-17 | CVE-2026-11407Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | pimcore/pimcore | high | not stated |
| 2026-06-11 | CVE-2026-49214CRLF injection via URI host component | guzzlehttp/psr7 | medium | 2.10.2 |
| 2026-06-11 | CVE-2026-48998Host confusion via authority reinterpretation | guzzlehttp/psr7 | medium | 2.10.2 |
| 2026-06-10 | CVE-2026-48011Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | shopware/core | low | 6.6.10.18, 6.7.10.1 |
| 2026-06-09 | CVE-2026-49742TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module | typo3/cms-core | high | 12.4.46, 13.4.31, 14.3.3 and 1 older lines |
| 2026-06-09 | CVE-2026-49741TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework | typo3/cms-core | high | 14.3.3 |
| 2026-06-09 | CVE-2026-49740TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API | typo3/cms-core | medium | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-49738TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer | typo3/cms-core | low | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47352TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API | typo3/cms-core | medium | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47351TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard | typo3/cms-core | medium | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47350TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler | typo3/cms-core | medium | 13.4.31, 14.3.3 |
| 2026-06-09 | CVE-2026-47349TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler | typo3/cms-core | medium | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47348TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search | typo3/cms-core | medium | 13.4.31, 14.3.3 |
| 2026-06-09 | CVE-2026-47347TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS | typo3/cms-core | medium | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47346TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework | typo3/cms-core | high | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-47343TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer | typo3/cms-core | high | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
| 2026-06-09 | CVE-2026-11607TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework | typo3/cms-core | high | 12.4.46, 13.4.31, 14.3.3 and 2 older lines |
May 2026 · 20 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-05-29 | CVE-2026-48557Spatie Laravel Media Library contains a file upload restriction bypass | spatie/laravel-medialibrary | high | 11.23.0 |
| 2026-05-29 | CVE-2026-48555Spatie Laravel Media Library contains a server-side request forgery vulnerability | spatie/laravel-medialibrary | medium | 11.23.0 |
| 2026-05-29 | CVE-2026-45660Statamic CMS: Server-Side Request Forgery via Glide | statamic/cms | medium | 5.73.22, 6.18.1 |
| 2026-05-20 | CVE-2026-9082Drupal Core has a SQL Injection issue | drupal/core | critical exploited | 11.1.10, 11.2.12, 11.3.10 and 3 older lines |
| 2026-05-20 | CVE-2026-39850Yii 2: Local file inclusion via view parameter name collision | yiisoft/yii2 | high | 2.0.55 |
| 2026-05-20 | CVE-2026-24425Possible sandbox bypass when using a source policy | twig/twig | high | 3.0.0, 3.26.0 |
| 2026-05-19 | CVE-2026-6367Drupal core allows Cross-Site Scripting (XSS) | drupal/core | medium | 11.3.7 |
| 2026-05-19 | CVE-2026-6366Drupal core allows Object Injection | drupal/core | medium | 10.6.7, 11.2.11, 11.3.7 and 1 older lines |
| 2026-05-19 | CVE-2026-6365Drupal core is Vulnerable to Cross-Site Scripting | drupal/core | medium | 10.6.7, 11.2.11, 11.3.7 and 1 older lines |
| 2026-05-12 | CVE-2026-44306Statamic CMS vulnerable to email enumeration via forgot password endpoint | statamic/cms | medium | 5.73.21, 6.15.0 |
| 2026-05-12 | CVE-2026-44167Phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() | phpseclib/phpseclib | high | not stated |
| 2026-05-12 | CVE-2026-44012Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | craftcms/cms | high | 5.9.18 |
| 2026-05-12 | CVE-2026-44011Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior | craftcms/cms | high | 4.17.12, 5.9.18 |
| 2026-05-12 | CVE-2026-44010Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | craftcms/cms | high | 4.17.12, 5.9.18 |
| 2026-05-12 | CVE-2026-40902PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | phpoffice/phpspreadsheet | high | not stated |
| 2026-05-12 | CVE-2026-40863PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | phpoffice/phpspreadsheet | high | not stated |
| 2026-05-08 | CVE-2026-41570Argument injection via newline in PHP INI values forwarded to child processes | phpunit/phpunit | high | 12.5.22, 13.1.6 |
| 2026-05-06 | CVE-2026-40296PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer | phpoffice/phpspreadsheet | medium | not stated |
| 2026-05-05 | CVE-2026-35453PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer | phpoffice/phpspreadsheet | medium | not stated |
| 2026-05-05 | CVE-2026-34084PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | phpoffice/phpspreadsheet | critical | not stated |
April 2026 · 13 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-04-27 | CVE-2026-5394Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save | pimcore/pimcore | high | 2026.1.3 |
| 2026-04-27 | CVE-2026-5362Pimcore has an authenticated Cross-site Scripting issue | pimcore/pimcore | medium | not stated |
| 2026-04-22 | CVE-2026-41175Statamic: Unsafe method invocation via query value resolution allows data destruction | statamic/cms | high | 5.73.20, 6.13.0 |
| 2026-04-22 | CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpoint | craftcms/cms | medium | not stated |
| 2026-04-22 | CVE-2026-41129Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations | craftcms/cms | medium | not stated |
| 2026-04-22 | CVE-2026-41128Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | craftcms/cms | medium | 5.9.15 |
| 2026-04-21 | CVE-2026-29179October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations | october/system | low | 3.7.16, 4.1.16 |
| 2026-04-21 | CVE-2026-27937October CMS: Reflected XSS via DataTable Form Widget | october/system | low | 3.7.16, 4.1.16 |
| 2026-04-21 | CVE-2026-26067October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | october/system | medium | 3.7.14, 4.1.10 |
| 2026-04-14 | CVE-2026-24907October CMS has Stored XSS in Event Log Mail Preview | october/system | medium | not stated |
| 2026-04-14 | CVE-2026-24906October CMS has Stored XSS in Backend Editor Markup Classes | october/system | medium | not stated |
| 2026-04-10 | CVE-2026-40194Phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() | phpseclib/phpseclib | low | 1.0.28, 2.0.53, 3.0.51 |
| 2026-04-09 | CVE-2026-39976Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens | laravel/passport | high | 13.7.1 |
March 2026 · 39 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-03-27 | CVE-2026-33887Statamic allows unauthorized content access through missing authorization in its revision controllers | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-27 | CVE-2026-33886Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-27 | CVE-2026-33885Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-27 | CVE-2026-33884Statamic's live preview token bypasses content protection for unrelated entries | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-27 | CVE-2026-33883Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-27 | CVE-2026-33882Statamic's Markdown preview endpoint exposes sensitive user data | statamic/cms | medium | 5.73.16, 6.7.2 |
| 2026-03-24 | CVE-2026-33347League/commonmark has an embed extension allowed_domains bypass | league/commonmark | medium | not stated |
| 2026-03-24 | CVE-2026-33162Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions | craftcms/cms | medium | not stated |
| 2026-03-24 | CVE-2026-33161Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | craftcms/cms | low | not stated |
| 2026-03-24 | CVE-2026-33160Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | craftcms/cms | low | not stated |
| 2026-03-24 | CVE-2026-33159Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | craftcms/cms | medium | not stated |
| 2026-03-24 | CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | craftcms/cms | medium | not stated |
| 2026-03-24 | CVE-2026-33157Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior | craftcms/cms | high | not stated |
| 2026-03-20 | CVE-2026-33177Statamic is missing authorization check on taxonomy term creation via fieldtype | statamic/cms | medium | 5.73.14, 6.7.0 |
| 2026-03-20 | CVE-2026-33172Statamic has Stored XSS via SVG Sanitization Bypass | statamic/cms | high | 5.73.14, 6.7.0 |
| 2026-03-20 | CVE-2026-33171Statamic has a path traversal in file dictionary fieldtype | statamic/cms | medium | 5.73.14, 6.7.0 |
| 2026-03-20 | CVE-2026-33051Craft CMS Vulnerable to Stored XSS in Revision Context Menu | craftcms/cms | medium | not stated |
| 2026-03-20 | CVE-2026-32935Phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack | phpseclib/phpseclib | high | not stated |
| 2026-03-16 | CVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | craftcms/cms | high | not stated |
| 2026-03-16 | CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | craftcms/cms | high | not stated |
| 2026-03-16 | CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesController | craftcms/cms | high | not stated |
| 2026-03-16 | CVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsController | craftcms/cms | medium | not stated |
| 2026-03-13 | CVE-2026-32612Statamic vulnerable to privilege escalation via stored cross-site scripting | statamic/cms | medium | 6.6.2 |
| 2026-03-11 | CVE-2026-31889Shopware vulnerable to a potential take over of app credentials | shopware/core | high | 6.6.10.15, 6.7.8.1 |
| 2026-03-11 | CVE-2026-31888Shopware has user enumeration via distinct error codes on Store API login endpoint | shopware/core | medium | 6.6.10.15, 6.7.8.1 |
| 2026-03-11 | CVE-2026-31887Shopware: Unauthenticated data extraction possible through store-api.order endpoint | shopware/core | high | 6.6.10.15, 6.7.8.1 |
| 2026-03-11 | CVE-2026-31859CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization | craftcms/cms | medium | not stated |
| 2026-03-11 | CVE-2026-31858CraftCMS's ElementSearchController Affected by Blind SQL Injection | craftcms/cms | high | not stated |
| 2026-03-11 | CVE-2026-31857CraftCMS has an RCE vulnerability via relational conditionals in the control panel | craftcms/cms | high | not stated |
| 2026-03-10 | CVE-2026-29113Craft CMS has a potential information disclosure vulnerability in preview tokens | craftcms/cms | low | 4.17.3, 5.9.7 |
| 2026-03-07 | CVE-2026-30838CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names | league/commonmark | medium | not stated |
| 2026-03-04 | CVE-2026-29069Craft CMS has unauthenticated activation email trigger with potential user enumeration | craftcms/cms | high | 4.17.0-beta.2, 5.9.0-beta.2 |
| 2026-03-04 | CVE-2026-28784Craft CMS has potential authenticated Remote Code Execution via Twig SSTI | craftcms/cms | medium | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28783Craft CMS has Twig Function Blocklist Bypass | craftcms/cms | medium | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28782Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action | craftcms/cms | medium | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28781Craft CMS: Entries Authorship Spoofing via Mass Assignment | craftcms/cms | medium | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28697Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates | craftcms/cms | critical | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28696Craft CMS has IDOR via GraphQL @parseRefs | craftcms/cms | high | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-04 | CVE-2026-28695Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | craftcms/cms | medium | 4.17.0-beta.1, 5.9.0-beta.1 |
February 2026 · 21 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-02-27 | CVE-2026-28426Statamic vulnerable to privilege escalation via stored cross-site scripting | statamic/cms | high | 5.73.11, 6.4.0 |
| 2026-02-27 | CVE-2026-28425Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs | statamic/cms | high | 5.73.16, 6.7.2 |
| 2026-02-27 | CVE-2026-28424Statamic's missing authorization allows access to email addresses | statamic/cms | medium | 5.73.11, 6.4.0 |
| 2026-02-27 | CVE-2026-28423Statamic Vulnerable to Server-Side Request Forgery via Glide | statamic/cms | medium | 5.73.11, 6.4.0 |
| 2026-02-27 | CVE-2026-27939Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass | statamic/cms | high | 6.4.0 |
| 2026-02-24 | CVE-2026-27593Statamic is vulnerable to account takeover via password reset link injection | statamic/cms | critical | 5.73.10, 6.7.1 |
| 2026-02-24 | CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause | pimcore/pimcore | medium | 12.3.3 |
| 2026-02-24 | CVE-2026-27129Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | craftcms/cms | medium | not stated |
| 2026-02-24 | CVE-2026-27128Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit | craftcms/cms | medium | not stated |
| 2026-02-24 | CVE-2026-27127Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | craftcms/cms | high | not stated |
| 2026-02-24 | CVE-2026-27126Craft CMS has Stored XSS in Table Field via "HTML" Column Type | craftcms/cms | medium | not stated |
| 2026-02-21 | CVE-2026-27196Statamic affected by privilege escalation via stored cross-site scripting | statamic/cms | high | 5.73.9, 6.3.2 |
| 2026-02-11 | CVE-2026-25759Statamic CMS vulnerable to privilege escalation via stored cross-site scripting | statamic/cms | high | 6.2.3 |
| 2026-02-11 | CVE-2026-25633Statamic CMS's missing authorization allows access to assets | statamic/cms | medium | 5.73.6, 6.2.5 |
| 2026-02-09 | CVE-2026-25498Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | craftcms/cms | high | not stated |
| 2026-02-09 | CVE-2026-25497Craft CMS: GraphQL Asset Mutation Privilege Escalation | craftcms/cms | high | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-02-09 | CVE-2026-25496Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields | craftcms/cms | medium | not stated |
| 2026-02-09 | CVE-2026-25495Craft CMS Vulnerable to SQL Injection in Element Indexes via criteria[orderBy] | craftcms/cms | high | not stated |
| 2026-02-09 | CVE-2026-25494Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation | craftcms/cms | medium | not stated |
| 2026-02-09 | CVE-2026-25493Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect | craftcms/cms | medium | not stated |
| 2026-02-09 | CVE-2026-25491Craft CMS Vulnerable to Stored XSS in Entry Types Name | craftcms/cms | low | not stated |
January 2026 · 15 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2026-01-28 | CVE-2026-24739Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows | symfony/process | medium | 7.3.11, 7.4.5, 8.0.5 and 2 older lines |
| 2026-01-27 | CVE-2026-24765Unsafe Deserialization in PHPT Code Coverage Handling | phpunit/phpunit | high | 10.5.62, 11.5.50, 12.5.8 and 2 older lines |
| 2026-01-16 | CVE-2026-23643CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting | cakephp/cakephp | medium | 5.2.12 |
| 2026-01-15 | CVE-2026-23494Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing | pimcore/pimcore | medium | not stated |
| 2026-01-15 | CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_log | pimcore/pimcore | high | not stated |
| 2026-01-14 | CVE-2026-23498Shopware Has Improper Control of Generation of Code in Twig rendered views | shopware/core | high | 6.7.6.1 |
| 2026-01-14 | CVE-2026-23492Pimcore Has an Incomplete Patch for CVE-2023-30848 | pimcore/pimcore | high | 12.3.1 |
| 2026-01-13 | CVE-2026-0859TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | typo3/cms-core | medium | not stated |
| 2026-01-10 | CVE-2025-61676October CMS Vulnerable to Stored XSS via Branding Styles | october/system | medium | not stated |
| 2026-01-10 | CVE-2025-61674October CMS Vulnerable to Stored XSS via Editor and Branding Styles | october/system | medium | not stated |
| 2026-01-05 | CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup | craftcms/cms | high | not stated |
| 2026-01-05 | CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | craftcms/cms | high | not stated |
| 2026-01-05 | CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | craftcms/cms | medium | not stated |
| 2026-01-05 | CVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | craftcms/cms | medium | not stated |
| 2026-01-05 | CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | craftcms/cms | medium | not stated |
December 2025 · 2 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2025-12-17 | CVE-2025-14761Key Commitment Issues in S3 Encryption Clients | aws/aws-sdk-php | medium | 3.368.0 |
| 2025-12-10 | CVE-2025-67507Filament multi-factor authentication (app) recovery codes can be used multiple times | filament/filament | high | 4.3.1 |
November 2025 · 5 CVEs
| Published | CVE | Package | Severity | Fixed in |
|---|---|---|---|---|
| 2025-11-18 | CVE-2025-13083Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels | drupal/core | low | 10.5.6, 11.1.9, 11.2.8 and 2 older lines |
| 2025-11-18 | CVE-2025-13082Drupal core allows Content Spoofing | drupal/core | low | 10.5.6, 11.1.9, 11.2.8 and 1 older lines |
| 2025-11-18 | CVE-2025-13081Drupal core allows Object Injection | drupal/core | medium | 10.5.6, 11.1.9, 11.2.8 and 1 older lines |
| 2025-11-18 | CVE-2025-13080Drupal core allows Forceful Browsing | drupal/core | low | 10.5.6, 11.1.9, 11.2.8 and 1 older lines |
| 2025-11-12 | CVE-2025-64500Incorrect parsing of PATH_INFO can lead to limited authorization bypass | symfony/http-foundation | high | 5.4.50, 6.4.29, 7.3.7 |
Check your whole project at once. Paste or upload composer.lock and see which installed packages have known advisories. Processed in memory, never stored.
Check composer.lockQuestions
Which PHP package vulnerabilities are listed here?
Every CVE published since 4 November 2025 for the 73 popular PHP and Laravel packages we track, where the NVD has a record. Older advisories are listed on each package's page.
How current is this list?
Advisories are synced from Packagist daily and CVE details from the NVD after each sync. The exploited-in-the-wild flag comes from the CISA Known Exploited Vulnerabilities catalog. Last advisory sync: 2026-11-04.
How do I check my own project?
Run composer audit in your project, or paste composer.lock into the free Composer vulnerability checker on this site. Both compare your installed versions with the same advisory data.
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fix