Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSSYESTERDAY · 28 OCT
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
fixed in 5.4.55 · 6.4.49 · 7.4.22 · 8.1.10
27 OCT
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
no fix yet
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
no fix yet
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
no fix yet
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
no fix yet
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
fixed in 13.4.4
23 OCT
Laravel TokenGuard authentication bypass through non-string API credentials
fixed in 12.68.0 · 13.29.0
Laravel relationship inclusion can trigger unauthorized data destruction
fixed in 12.68.0 · 13.27.0
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
fixed in 4.4.8
14 OCT
CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
fixed in 5.4.54 · 6.4.48 · 7.4.21 · 8.1.9
8 OCT
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
no fix yet
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
no fix yet
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
no fix yet
30 SEP
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
no fix yet
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
no fix yet
29 SEP
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
no fix yet
28 SEP
Accessibility Audit 1.5.0 is a critical release
fixed in 1.5.0
Order Lifecycle 2.0.0 is a critical release
fixed in 2.0.0
Clicky Analytics 1.1.0 is a critical release
fixed in 1.0.2 · 1.1.0
Stripe Reconciler 1.1.0 is a critical release
fixed in 1.1.0
24 SEP
zbateson/mail-mime-parser has CRLF header injection via attachment filename
fixed in 3.0.6 · 4.0.2
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
fixed in 3.0.6 · 4.0.2
23 SEP
Formie: Missing authorization on sent notification resend modal exposes submission PII
fixed in 2.2.23 · 3.1.31
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
fixed in 2.2.23 · 3.1.31
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
fixed in 2.2.23 · 3.1.31
20 SEP
Servd Assets and Helpers 2.11.7 is a critical release
fixed in 2.11.7 · 3.7.6 · 4.2.7
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.