Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS5 JAN
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
no fix yet
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
no fix yet
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
no fix yet
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
no fix yet
31 DEC 2025
libsodium has Incomplete List of Disallowed Inputs
fixed in 1.24.0 · 2.5.0
30 DEC 2025
Missing check that a point is on the prime subgroup for Edwards25519
fixed in 1.24.0 · 2.5.0
17 DEC 2025
12 NOV 2025
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
fixed in 5.4.50 · 6.4.29 · 7.3.7
30 OCT 2025
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
no fix yet
25 AUG 2025
12 AUG 2025
svg-sanitizer Bypasses Attribute Sanitization
fixed in 0.22.0
8 AUG 2025
Craft CMS has a theoretical bypass for CVE-2025-23209
fixed in 4.16.3 · 5.8.4
3 AUG 2025
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
fixed in 1.30.0 · 2.1.12 · 2.4.0 · 3.10.0 · 5.0.0
31 JUL 2025
17 JUL 2025
Livewire is vulnerable to remote command execution during component property update hydration
fixed in 3.6.4
8 MAY 2025
Craft CMS stores arbitrary content provided by unauthenticated users in session files
fixed in 4.15.3 · 5.7.5
5 MAY 2025
league/commonmark contains a XSS vulnerability in Attributes extension
fixed in 2.7.0
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
no fix yet
25 APR 2025
11 APR 2025
Formie has XSS vulnerability for email notification content for preview
no fix yet
10 APR 2025
Craft CMS 5.6.17 is a critical release
fixed in 3.9.15 · 4.14.15 · 5.6.17
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
fixed in 2.0.52
4 APR 2025
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function
no fix yet
5 MAR 2025
Laravel has a File Validation Bypass
fixed in 10.48.29 · 11.44.1 · 12.1.1
5 FEB 2025
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.