porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

1 JAN 2024

HIGH8.2
amphp/http-client composer

Denial of Service via HTTP/2 CONTINUATION Frames

no fix yet

HIGH8.2
amphp/http composer

Denial of Service via HTTP/2 CONTINUATION Frames

no fix yet

13 DEC 2023

MODERATE5.3
phenx/php-svg-lib composer

Denial of service caused by infinite recursion when parsing SVG document

fixed in 0.5.1

12 DEC 2023

MODERATE5.3
dompdf/dompdf composer

Denial of service caused by infinite recursion when parsing SVG images

fixed in 2.0.4

23 NOV 2023

MODERATE6.1
rhukster/dom-sanitizer composer

Cross-site Scripting in DOMSanitizer

fixed in 1.0.7

22 NOV 2023

HIGH7.5
statamic/cms composer

Cross-site Scripting via uploaded assets

fixed in 3.4.15 · 4.36.0

MODERATE6.0
aws/aws-sdk-php composer

Potential URI resolution path traversal in the AWS SDK for PHP

fixed in 3.288.1

14 NOV 2023

HIGH8.8
statamic/cms composer

Statamic CMS vulnerable to remote code execution via form uploads

fixed in 3.4.14 · 4.34.0

12 NOV 2023

HIGH8.3
statamic/cms composer

Statamic CMS remote code execution via front-end form uploads

fixed in 3.4.13 · 4.33.0

13 SEP 2023

CRITICAL10.0
craftcms/cms composer

Craft CMS Remote Code Execution vulnerability

no fix yet

21 AUG 2023

HIGH7.2
craftcms/cms composer

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

no fix yet

6 JUL 2023

MODERATE5.5
statamic/cms composer

Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

fixed in 4.10.0

20 JUN 2023

MODERATE6.1
craftcms/cms composer

Craft CMS vulnerable to HTML injection

no fix yet

26 MAY 2023

MODERATE5.4
craftcms/cms composer

Stored cross site scripting in Craft CMS

fixed in 4.4.12

MODERATE5.5
craftcms/cms composer

Craft CMS stored XSS in indexedVolumes

no fix yet

MODERATE5.5
craftcms/cms composer

Craft CMS stored XSS in review volume

no fix yet

MODERATE6.1
craftcms/cms composer

Craft CMS XSS in RSS widget feed

no fix yet

LOW3.7
craftcms/cms composer

CraftCMS stored XSS in Quick Post widget error message

fixed in 4.4.6

22 MAY 2023

HIGH7.2
craftcms/cms composer

Craft CMS vulnerable to Remote Code Execution via unrestricted file extension

fixed in 4.4.6

12 MAY 2023

HIGH8.8
craftcms/cms composer

CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

no fix yet

5 MAY 2023

MODERATE6.1
craftcms/cms composer

craftcms/cms vulnerable to cross site scripting in RSS feed widget

no fix yet

25 APR 2023

MODERATE6.1
craftcms/cms composer

Cross Site Scripting in CraftCMS

fixed in 3.7.68

17 APR 2023

MODERATE5.3
guzzlehttp/psr7 composer

Improper header validation

fixed in 1.9.1 · 2.4.5

3 MAR 2023

MODERATE6.1
craftcms/cms composer

Craft CMS Stored Cross-site Scripting Injection Vulnerability

fixed in 3.7.64 · 4.3.7

7 FEB 2023

CRITICAL10.0
dompdf/dompdf composer

URI validation failure on SVG parsing. Bypass of CVE-2023-23924

no fix yet

1 FEB 2023

MODERATE5.9
symfony/http-kernel composer

CVE-2022-24894: Prevent storing cookie headers in HttpCache

fixed in 4.4.50 · 5.4.20 · 6.0.20 · 6.1.12 · 6.2.6

31 JAN 2023

CRITICAL10.0
dompdf/dompdf composer

Dompdf vulnerable to URI validation failure on SVG parsing

fixed in 2.0.2

5 DEC 2022

HIGH7.5
craftcms/cms composer

Craft CMS discloses password hashes

no fix yet

25 NOV 2022

MODERATE6.1
spatie/browsershot composer

Browsershot vulnerable to Cross-Site Scripting (XSS)

fixed in 3.57.3

HIGH8.2
spatie/browsershot composer

Browsershot does not validate URL protocols passed to Browsershot URL method

fixed in 3.57.3

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →