porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

26 MAY

MODERATE
symfony/routing composer

CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

fixed in 5.4.53 · 6.4.41 · 7.4.13 · 8.0.13

LOW
symfony/polyfill-intl-idn composer

CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

fixed in 1.38.1

MODERATE
symfony/http-foundation composer

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

fixed in 6.4.41 · 7.4.13 · 8.0.13

25 MAY

MODERATE5.3
guzzlehttp/psr7 composer

Host confusion via authority reinterpretation

fixed in 2.10.2

MODERATE5.3
guzzlehttp/psr7 composer

CRLF injection via URI host component

fixed in 2.10.2

20 MAY

MODERATE
twig/twig composer

`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

fixed in 3.26.0

HIGH
twig/twig composer

Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

fixed in 3.26.0

HIGH
twig/twig composer

Possible sandbox bypass when using a source policy

fixed in 3.0.0 · 3.26.0

MODERATE
twig/twig composer

`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

fixed in 3.26.0

LOW
twig/twig composer

Sandbox property allowlist bypass via the `column` filter (array_column on objects)

fixed in 3.26.0

UNRATED
twig/twig composer

Sandbox does not protect against resource exhaustion

fixed in 3.26.0

HIGH
twig/twig composer

Sandbox property and method bypass via object-destructuring assignment

fixed in 3.26.0

LOW
twig/twig composer

XSS in profiler HtmlDumper via unescaped template and profile names

fixed in 3.26.0

CRITICAL
twig/twig composer

PHP code injection via `{% use %}` template name

fixed in 3.26.0

LOW
twig/twig composer

The `spaceless` filter implicitly marks its output as safe

fixed in 3.26.0

HIGH
twig/twig composer

Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

fixed in 3.26.0

LOW
symfony/dom-crawler composer

CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

MODERATE
symfony/cache composer

CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

LOW
symfony/yaml composer

CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

LOW
symfony/yaml composer

CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

LOW
symfony/yaml composer

CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

MODERATE
symfony/routing composer

CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

HIGH
symfony/mime composer

CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

MODERATE
symfony/mailer composer

CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

HIGH
symfony/http-kernel composer

CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

fixed in 7.4.12 · 8.0.12

19 MAY

UNRATED8.9
laravel/framework composer

Laravel CRLF injection in default email rule

fixed in 12.60.0 · 13.10.0

18 MAY

CRITICAL9.8
verbb/formie composer

Formie: Pre-authenticated server-side template injection in Hidden fields

fixed in 2.2.20 · 3.1.24

MODERATE5.4
statamic/cms composer

Statamic CMS: Server-Side Request Forgery via Glide

fixed in 5.73.22 · 6.18.1

11 MAY

HIGH7.4
yiisoft/yii2 composer

Yii 2: Local file inclusion via view parameter name collision

fixed in 2.0.55

6 MAY

MODERATE5.3
statamic/cms composer

Statamic CMS vulnerable to email enumeration via forgot password endpoint

fixed in 5.73.21 · 6.15.0

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →