Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS3 MAR
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
1 MAR
Statamic vulnerable to privilege escalation via stored cross-site scripting
fixed in 5.73.11 · 6.4.0
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
fixed in 5.73.16 · 6.7.2
Statamic's missing authorization allows access to email addresses
fixed in 5.73.11 · 6.4.0
Statamic Vulnerable to Server-Side Request Forgery via Glide
fixed in 5.73.11 · 6.4.0
27 FEB
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
fixed in 6.4.0
25 FEB
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
no fix yet
24 FEB
Statamic is vulnerable to account takeover via password reset link injection
fixed in 5.73.10 · 6.7.1
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
no fix yet
23 FEB
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
no fix yet
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
no fix yet
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
no fix yet
22 FEB
19 FEB
Statamic affected by privilege escalation via stored cross-site scripting
fixed in 5.73.9 · 6.3.2
18 FEB
Formie 3.1.14 is a critical release
fixed in 2.2.12 · 2.2.13 · 3.1.13 · 3.1.14
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
fixed in 7.5.8
11 FEB
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
fixed in 6.2.3
Statamic CMS's missing authorization allows access to assets
fixed in 5.73.6 · 6.2.5
9 FEB
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
no fix yet
Craft CMS: GraphQL Asset Mutation Privilege Escalation
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
no fix yet
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
no fix yet
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.