Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS1 MAR
Statamic vulnerable to privilege escalation via stored cross-site scripting
fixed in 5.73.11 · 6.4.0
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
fixed in 5.73.16 · 6.7.2
Statamic's missing authorization allows access to email addresses
fixed in 5.73.11 · 6.4.0
Statamic Vulnerable to Server-Side Request Forgery via Glide
fixed in 5.73.11 · 6.4.0
27 FEB
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
fixed in 6.4.0
25 FEB
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
no fix yet
24 FEB
Statamic is vulnerable to account takeover via password reset link injection
fixed in 5.73.10 · 6.7.1
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
no fix yet
23 FEB
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
no fix yet
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
no fix yet
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
no fix yet
22 FEB
19 FEB
Statamic affected by privilege escalation via stored cross-site scripting
fixed in 5.73.9 · 6.3.2
18 FEB
Formie 3.1.14 is a critical release
fixed in 2.2.12 · 2.2.13 · 3.1.13 · 3.1.14
11 FEB
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
fixed in 6.2.3
Statamic CMS's missing authorization allows access to assets
fixed in 5.73.6 · 6.2.5
9 FEB
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
no fix yet
Craft CMS: GraphQL Asset Mutation Privilege Escalation
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
no fix yet
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
no fix yet
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
no fix yet
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
no fix yet
30 JAN
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
no fix yet
28 JAN
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
fixed in 5.4.51 · 6.4.33 · 7.3.11 · 7.4.5 · 8.0.5
27 JAN
Unsafe Deserialization in PHPT Code Coverage Handling
fixed in 8.5.52 · 9.6.33 · 10.5.62 · 11.5.50 · 12.5.8
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.