Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS3 FEB 2025
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
fixed in 1.29.9 · 2.1.8 · 2.3.7 · 3.9.0
29 JAN 2025
Missing output escaping for the null coalesce operator
fixed in 3.19.0
21 JAN 2025
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
fixed in 1.29.8 · 2.1.7 · 2.3.6 · 3.8.0
Craft CMS has a potential RCE with a compromised security key
fixed in 4.13.8 · 5.5.5
8 JAN 2025
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
fixed in 2.72.6 · 3.8.4
3 JAN 2025
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
fixed in 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
fixed in 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
fixed in 3.7.0
20 DEC 2024
Browsershot Improper Input Validation vulnerability
fixed in 5.0.3
19 DEC 2024
18 DEC 2024
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
fixed in 3.9.14 · 4.13.2 · 5.5.2
Spatie Browsershot Directory Traversal vulnerability
fixed in 5.0.2
13 DEC 2024
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
fixed in 11.36.0
Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
fixed in 11.36.0
9 DEC 2024
league/commonmark's quadratic complexity bugs may lead to a denial of service
fixed in 2.6.0
19 NOV 2024
18 NOV 2024
XXE in PHPSpreadsheet's XLSX reader
fixed in 1.29.4 · 2.1.3 · 2.3.2 · 3.4.0
XmlScanner bypass leads to XXE
fixed in 1.29.4 · 2.1.3 · 2.3.2 · 3.4.0
15 NOV 2024
Deserialization of Untrusted Data in dompdf/dompdf
fixed in 2.0.0
Improper Restriction of XML External Entity Reference in dompdf/dompdf
fixed in 2.0.0
13 NOV 2024
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
no fix yet
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
no fix yet
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
fixed in 5.4.47 · 6.4.15 · 7.1.8
12 NOV 2024
Laravel environment manipulation via query string
fixed in 6.20.45 · 7.30.7 · 8.83.28 · 9.52.17 · 10.48.23 · 11.31.0
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.