Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS6 JUL
Formie Hidden field defaults vulnerable to Server-Side Template Injection
fixed in 3.1.27
5 JUL
Pricing Rules Relationship 1.0.3 is a critical release
fixed in 1.0.3
2 JUL
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
fixed in 4.17.14 · 5.9.21
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
fixed in 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
fixed in 4.17.15 · 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
fixed in 4.17.14 · 5.9.21
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
fixed in 5.9.21
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
fixed in 5.9.21
1 JUL
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
no fix yet
26 JUN
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
fixed in 5.74.0 · 6.20.3
Statamic Vulnerable to CSV formula injection in form submission exports
fixed in 5.73.24 · 6.20.1
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
fixed in 5.73.24 · 6.20.1
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
fixed in 5.73.23 · 6.20.0
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
fixed in 5.73.23 · 6.20.0
25 JUN
Tiptap contains an input validation vulnerability resulting in DoS
fixed in 2.1.1
19 JUN
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
fixed in 4.18 · 5.10
18 JUN
CRLF injection in HTTP start-line serialization
fixed in 2.12.1
17 JUN
Laravel Framework: Temporary Signed URL Path Confusion
fixed in 12.61.1 · 13.12.0
Laravel Framework: CRLF injection in default email rule
fixed in 12.60.0
11 JUN
CompilerRuntime code injection via unescaped function names
fixed in 2.9.1
8 JUN
PHPSpreadsheet has a patch bypass for CVE-2026-34084
no fix yet
29 MAY
formie's unauthenticated front-end submission editing can overwrite existing submissions
fixed in 2.2.21 · 3.1.26
27 MAY
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
fixed in 3.27.0
Sandbox `__toString()` policy bypass via dynamic mapping keys
fixed in 3.27.0
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
fixed in 3.27.0
Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
fixed in 3.27.0
Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
fixed in 3.27.0
26 MAY
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
fixed in 5.4.53
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.