porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

17 MAY 2022

MODERATE6.1
laravel/laravel composer

Laravel does not properly constrain the host portion of a password-reset URL

fixed in 5.4.22

MODERATE6.1
yiisoft/yii2 composer

Yii Cross-site Scripting Framework vulnerability

no fix yet

MODERATE5.4
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 2.6.2982

MODERATE6.1
filp/whoops composer

filp whoops Cross-site Scripting vulnerability

fixed in 2.1.13

14 MAY 2022

MODERATE5.9
yiisoft/yii2 composer

Yii Incorrectly Implements CORS

fixed in 2.0.16

CRITICAL9.8
laravel/framework composer

Laravel Framework Deserialization Vulnerability

fixed in 6.20.44

MODERATE4.8
craftcms/cms composer

Craft CMS Cross-site Scripting (XSS) Vulnerability

no fix yet

HIGH8.1
laravel/framework composer

Laravel Framework RCE Vulnerability

no fix yet

13 MAY 2022

HIGH7.2
craftcms/cms composer

Craft CMS Vulnerable to Server-Side Template Injection

no fix yet

MODERATE5.3
craftcms/cms composer

Craft CMS Unauthorized View

fixed in 2.6.2976

HIGH8.8
craftcms/cms composer

Craft CMS PHP Code Injection Vulnerability

no fix yet

HIGH7.5
nystudio107/craft-seomatic composer

SEOmatic plugin for Craft CMS SSTI Vulnerability

fixed in 3.1.4

HIGH8.8
statamic/cms composer

Statamic framework Incorrect Permission Assignment

fixed in 2.6.0

10 MAY 2022

HIGH8.8
craftcms/cms composer

Improper account password reset in Craft CMS

fixed in 3.7.36

1 MAY 2022

MODERATE6.1
ezyang/htmlpurifier composer

HTML Purifier Cross-site Scripting vulnerability

fixed in 2.0.1

5 APR 2022

LOW
craftcms/cms composer

XSS Injection Vulnerability

fixed in 3.7.29

4 APR 2022

MODERATE6.1
craftcms/cms composer

Cross-site Scripting in craftcms/cms

fixed in 3.7.29

30 MAR 2022

CRITICAL9.1
firebase/php-jwt composer

Key/algorithm type confusion

fixed in 6.0.0

29 MAR 2022

LOW3.7
statamic/cms composer

Discoverability of user password hash in Statamic CMS

fixed in 3.2.39 · 3.3.2

24 MAR 2022

CRITICAL9.8
dompdf/dompdf composer

Remote code injection via remote fonts

fixed in 1.2.1

20 MAR 2022

MODERATE5.3
guzzlehttp/psr7 composer

Inproper parsing of HTTP headers

fixed in 1.8.4 · 2.1.1

18 MAR 2022

MODERATE6.1
craftcms/cms composer

Craft CMS Cross-site Scripting Vulnerability

fixed in 3.6.13

12 MAR 2022

HIGH9.8
nystudio107/craft-seomatic composer

Server-side Template Injection in nystudio107/craft-seomatic

fixed in 3.4.12

15 FEB 2022

MODERATE6.2
enshrined/svg-sanitize composer

A cross-site scripting vulnerability

fixed in 0.15.0

4 FEB 2022

HIGH8.8
twig/twig composer

Disallow non closures in the sort filter

fixed in 2.14.11 · 3.3.8

6 JAN 2022

HIGH8.8
laravel/framework composer

OS Command Injection in Laravel Framework

fixed in 5.8.17

18 NOV 2021

UNRATED9.8
laravel/framework composer

Image upload bypass

fixed in 8.71.0

15 NOV 2021

MODERATE6.5
symfony/serializer composer

CVE-2021-41270: Prevent CSV Injection via formulas

fixed in 4.4.35 · 5.3.12

18 OCT 2021

HIGH8.8
craftcms/cms composer

CSV Injection Vulnerability

fixed in 3.7.14

9 OCT 2021

MODERATE6.5
symfony/http-kernel composer

CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

fixed in 5.3.12

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →