porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

4 OCT 2021

MODERATE6.1
james-heinrich/getid3 composer

Cross-site scripting in demos/demo.mysqli.php in getID3

fixed in 1.9.21

28 SEP 2021

MODERATE4.4
lcobucci/jwt composer

CVE-2021-41106: File reference keys leads to incorrect hashes on HMAC algorithms

fixed in 3.4.6 · 4.0.4 · 4.1.5

2 JUL 2021

CRITICAL9.8
craftcms/cms composer

Craft CMS Remote Code Injection

fixed in 3.6.7

MODERATE6.1
craftcms/cms composer

Craft CMS Cross-site Scripting Vulnerability

fixed in 3.6.0

23 JUN 2021

CRITICAL9.8
league/flysystem composer

TOCTOU Race Condition enabling remote code execution

fixed in 1.1.4 · 2.1.1

6 MAY 2021

HIGH7.5
laravel/framework composer

Improper Input Validation in Laravel

fixed in 6.18.35 · 7.24.0

28 APR 2021

MODERATE
laravel/framework composer

SQL Server LIMIT / OFFSET SQL Injection

fixed in 6.20.26 · 7.30.5 · 8.40.0

21 JAN 2021

HIGH7.2
laravel/framework composer

Unexpected bindings in QueryBuilder

fixed in 6.20.14 · 7.30.4 · 8.24.0

1 JAN 2021

MODERATE6.1
laravel/framework composer

Possible cross-site scripting (XSS) vulnerability in the Blade templating engine

fixed in 6.20.42 · 7.30.6 · 8.75.0

31 DEC 2020

MODERATE6.4
phpoffice/phpspreadsheet composer

XSS Vulnerability in HTML Writer

fixed in 1.16.0

22 SEP 2020

MODERATE
livewire/livewire composer

$this->validate() returns all properties, not just validated ones

fixed in 2.2.6

14 SEP 2020

HIGH10.0
yiisoft/yii2 composer

Possible remote code execution via unserialize() on user input containing specially crafted string

fixed in 2.0.38

2 SEP 2020

HIGH8.8
symfony/http-kernel composer

CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient

fixed in 4.4.13 · 5.1.5

6 AUG 2020

CRITICAL
laravel/framework composer

Guard bypass in Eloquent models

fixed in 6.18.34 · 7.23.2

27 JUL 2020

MODERATE
laravel/framework composer

RCE vulnerability in "cookie" session driver

fixed in 6.18.31 · 7.22.4

16 JUN 2020

HIGH
amphp/http-client composer

Header leakage on cross-domain redirects

fixed in 4.4.0

28 APR 2020

UNRATED
nystudio107/craft-seomatic composer

SSTI Vulnerability

fixed in 3.3.0

30 MAR 2020

LOW4.3
symfony/http-foundation composer

CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header

fixed in 4.4.7 · 5.0.7

MODERATE5.4
symfony/error-handler composer

CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler

fixed in 4.4.4 · 5.0.4

13 MAR 2020

MODERATE
laravel/framework composer

XSS vulnerability in blade templating

fixed in 7.1.2

27 FEB 2020

MODERATE6.1
enshrined/svg-sanitize composer

Sanitizer bypass in svg-sanitizer

fixed in 0.13.1

13 JAN 2020

HIGH5.3
laravel/framework composer

Unexpected bindings in QueryBuilder

fixed in 6.20.11 · 7.30.2 · 8.22.1

8 JAN 2020

HIGH7.5
enshrined/svg-sanitize composer

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

fixed in 0.12.0

1 JAN 2020

CRITICAL9.8
sabberworm/php-css-parser composer

Code injection vulnerability in allSelectors()

fixed in 1.0.1 · 2.0.1 · 3.0.1 · 4.0.1 · 5.0.9 · 5.1.3 · 5.2.1 · 6.0.2 · 7.0.4 · 8.0.1 · 8.1.1 · 8.2.1 · 8.3.1

13 NOV 2019

CRITICAL9.8
symfony/cache composer

CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances

fixed in 3.4.35 · 4.2.12 · 4.3.8

CRITICAL9.8
symfony/var-exporter composer

CVE-2019-11325: Fix escaping of strings in VarExporter

fixed in 4.2.12 · 4.3.8

HIGH7.5
symfony/mime composer

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

fixed in 4.3.8

HIGH8.1
symfony/http-kernel composer

CVE-2019-18887: Use constant time comparison in UriSigner

fixed in 2.8.52 · 3.4.35 · 4.2.12 · 4.3.8

HIGH7.5
symfony/http-foundation composer

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

fixed in 2.8.52 · 3.4.35 · 4.2.12 · 4.3.8

1 JUL 2019

HIGH8.8
phpoffice/phpspreadsheet composer

XXE Vulnerability

fixed in 1.8.0

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →