Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS8 AUG 2025
Craft CMS has a theoretical bypass for CVE-2025-23209
fixed in 4.16.3 · 5.8.4
3 AUG 2025
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
fixed in 1.30.0 · 2.1.12 · 2.4.0 · 3.10.0 · 5.0.0
31 JUL 2025
17 JUL 2025
Livewire is vulnerable to remote command execution during component property update hydration
fixed in 3.6.4
8 MAY 2025
Craft CMS stores arbitrary content provided by unauthenticated users in session files
fixed in 4.15.3 · 5.7.5
5 MAY 2025
league/commonmark contains a XSS vulnerability in Attributes extension
fixed in 2.7.0
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
no fix yet
25 APR 2025
11 APR 2025
Formie has XSS vulnerability for email notification content for preview
no fix yet
10 APR 2025
Craft CMS 5.6.17 is a critical release
fixed in 3.9.15 · 4.14.15 · 5.6.17
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
fixed in 2.0.52
4 APR 2025
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function
no fix yet
5 MAR 2025
Laravel has a File Validation Bypass
fixed in 10.48.29 · 11.44.1 · 12.1.1
5 FEB 2025
3 FEB 2025
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
fixed in 1.29.9 · 2.1.8 · 2.3.7 · 3.9.0
29 JAN 2025
Missing output escaping for the null coalesce operator
fixed in 3.19.0
21 JAN 2025
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
fixed in 1.29.8 · 2.1.7 · 2.3.6 · 3.8.0
Craft CMS has a potential RCE with a compromised security key
fixed in 4.13.8 · 5.5.5
8 JAN 2025
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
fixed in 2.72.6 · 3.8.4
3 JAN 2025
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
fixed in 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
fixed in 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
fixed in 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
fixed in 3.7.0
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.