Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS15 SEP
CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
fixed in 5.4.54 · 6.4.46 · 7.4.19 · 8.1.7
8 SEP
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
fixed in 3.3.0
2 SEP
Livewire DOM-based cross-site scripting during client-side state handling
no fix yet
1 SEP
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
fixed in 2.10.0
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
fixed in 2.9.1
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
fixed in 2.9.1
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
fixed in 2.9.1
30 AUG
CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
fixed in 5.4.54 · 6.4.45 · 7.4.18 · 8.1.6
18 AUG
Incorrect Ed25519 public key validation
fixed in 1.24.1 · 2.5.1
7 AUG
Craft CMS: Passkey login accepts replayed WebAuthn assertions
fixed in 5.10.5
6 AUG
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
fixed in 4.18.2 · 5.10.6
Craft CMS: Authenticated leak of secret environment variables
fixed in 4.18.2 · 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
fixed in 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
fixed in 4.18.1 · 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
fixed in 4.18.2 · 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
fixed in 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
fixed in 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
fixed in 4.18.3 · 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
fixed in 4.18.1 · 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
fixed in 4.18.2 · 5.10.6
league/commonmark: Denial of service via deeply nested XML output
fixed in 2.9.0
league/commonmark: Denial of service via colliding heading slugs
fixed in 2.9.0
league/commonmark: Denial of service via duplicate footnote definitions
fixed in 2.9.0
league/commonmark: Denial of service via adjacent inline attribute blocks
fixed in 2.9.0
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
fixed in 2.9.0
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
no fix yet
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
fixed in 5.74.3 · 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
fixed in 5.74.3 · 6.24.2
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
fixed in 5.74.1 · 6.24.0
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
fixed in 5.74.1 · 6.24.0
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.