porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

16 APR 2019

HIGH7.1
symfony/cache composer

CVE-2019-10912: Prevent destructors with side-effects from being unserialized

fixed in 3.4.26 · 4.1.12 · 4.2.7

CRITICAL9.8
symfony/http-foundation composer

CVE-2019-10913: Reject invalid HTTP method overrides

fixed in 2.7.51 · 2.8.50 · 3.4.26 · 4.1.12 · 4.2.7

21 MAR 2019

MODERATE6.1
league/commonmark composer

XSS vulnerability with double-encoded entities

fixed in 0.18.3

12 MAR 2019

LOW3.7
twig/twig composer

Sandbox Information Disclosure

fixed in 1.38.0 · 2.7.0

29 DEC 2018

MODERATE6.1
league/commonmark composer

XSS vulnerability with unsafe link protocols

fixed in 0.18.1

20 NOV 2018

HIGH8.8
phpoffice/phpspreadsheet composer

XXE Vulnerability

fixed in 1.5.1

8 AUG 2018

HIGH
laravel/framework composer

Cookie serialization vulnerability

fixed in 5.5.42 · 5.6.30

1 AUG 2018

MODERATE6.5
symfony/http-foundation composer

CVE-2018-14773: Remove support for legacy and risky HTTP headers

fixed in 2.7.49 · 2.8.44 · 3.3.18 · 3.4.14 · 4.0.14 · 4.1.3

25 MAY 2018

MODERATE5.9
symfony/http-foundation composer

CVE-2018-11386: Denial of service when using PDOSessionHandler

fixed in 2.7.48 · 2.8.41 · 3.3.17 · 3.4.11 · 4.0.11

30 MAR 2018

HIGH
laravel/framework composer

Exploit of encryption failure vulnerability

fixed in 5.5.40 · 5.6.15

20 MAR 2018

UNRATED9.8
yiisoft/yii2 composer

Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`

fixed in 2.0.12.1 · 2.0.13.2 · 2.0.15

15 MAR 2018

MODERATE
amphp/http composer

Incorrect header injection check

fixed in 1.0.1

22 JAN 2018

HIGH7.5
yiisoft/yii2 composer

Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

fixed in 2.0.14

13 JAN 2018

HIGH8.8
yiisoft/yii2 composer

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

fixed in 2.0.14

21 SEP 2017

MODERATE5.9
laravel/framework composer

Timing attack vector for remember me token

fixed in 5.5.10

7 MAY 2017

MODERATE6.1
laravel/framework composer

Password reset phishing vulnerability

fixed in 5.4.22

13 NOV 2016

CRITICAL9.8
phpunit/phpunit composer

RCE vulnerability in phpunit

fixed in 4.8.28 · 5.6.3

15 JUL 2016

HIGH8.1
guzzlehttp/guzzle composer

HTTP Proxy header vulnerability

fixed in 4.2.4 · 5.3.1 · 6.2.1

7 DEC 2015

MODERATE6.5
dompdf/dompdf composer

Information Disclosure

fixed in 0.6.2

HIGH8.8
dompdf/dompdf composer

Remote Code Execution (complement of CVE-2014-2383)

fixed in 0.6.2

MODERATE6.5
dompdf/dompdf composer

Denial Of Service Vector

fixed in 0.6.2

12 AUG 2015

HIGH
twig/twig composer

Remote code execution in templates

fixed in 1.20.0

24 JUL 2015

HIGH7.8
aws/aws-sdk-php composer

Security Misconfiguration Vulnerability in the AWS SDK for PHP

fixed in 3.2.1

10 JUL 2015

CRITICAL
yiisoft/yii2 composer

class yii\web\ViewAction allowed to include arbitrary files that end with .php

fixed in 2.0.5

26 MAY 2015

MODERATE
symfony/http-kernel composer

CVE-2015-4050: ESI unauthorized access

fixed in 2.3.29 · 2.5.0 · 2.5.12 · 2.6.8

10 MAY 2015

MODERATE
yiisoft/yii2 composer

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

fixed in 2.0.4

2 APR 2015

CRITICAL
firebase/php-jwt composer

Critical vulnerabilities in JSON Web Token libraries

fixed in 2.0.0

1 APR 2015

MODERATE
symfony/http-kernel composer

Esi Code Injection

fixed in 2.3.27 · 2.5.11 · 2.6.6

MODERATE
symfony/http-foundation composer

Unsafe methods in the Request class

fixed in 2.3.27 · 2.5.11 · 2.6.6

29 DEC 2014

LOW
monolog/monolog composer

Header injection in NativeMailerHandler

fixed in 1.12.0

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →