Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS20 DEC 2024
Browsershot Improper Input Validation vulnerability
fixed in 5.0.3
19 DEC 2024
18 DEC 2024
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
fixed in 3.9.14 · 4.13.2 · 5.5.2
Spatie Browsershot Directory Traversal vulnerability
fixed in 5.0.2
13 DEC 2024
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
fixed in 11.36.0
Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
fixed in 11.36.0
9 DEC 2024
league/commonmark's quadratic complexity bugs may lead to a denial of service
fixed in 2.6.0
19 NOV 2024
18 NOV 2024
XXE in PHPSpreadsheet's XLSX reader
fixed in 1.29.4 · 2.1.3 · 2.3.2 · 3.4.0
XmlScanner bypass leads to XXE
fixed in 1.29.4 · 2.1.3 · 2.3.2 · 3.4.0
15 NOV 2024
Deserialization of Untrusted Data in dompdf/dompdf
fixed in 2.0.0
Improper Restriction of XML External Entity Reference in dompdf/dompdf
fixed in 2.0.0
13 NOV 2024
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
no fix yet
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
no fix yet
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
fixed in 5.4.47 · 6.4.15 · 7.1.8
12 NOV 2024
Laravel environment manipulation via query string
fixed in 6.20.45 · 7.30.7 · 8.83.28 · 9.52.17 · 10.48.23 · 11.31.0
6 NOV 2024
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
fixed in 3.11.2 · 3.14.1
Unguarded calls to __toString() when nesting an object into an array
fixed in 3.11.2 · 3.14.1
5 NOV 2024
CVE-2024-51736: Command execution hijack on Windows with Process class
fixed in 5.4.46 · 6.4.14 · 7.1.7
CVE-2024-50345: Open redirect via browser-sanitized URLs
fixed in 5.4.46 · 6.4.14 · 7.1.7
8 OCT 2024
Livewire Remote Code Execution on File Uploads
fixed in 2.12.7 · 3.5.2
7 OCT 2024
XXE in PHPSpreadsheet's XLSX reader
fixed in 1.29.1 · 2.1.1 · 2.3.0
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
fixed in 1.29.2 · 2.1.1 · 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
fixed in 1.29.2 · 2.1.1 · 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
fixed in 1.29.2 · 2.1.1 · 2.3.0
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
fixed in 1.29.2 · 2.1.1 · 2.3.0
9 SEP 2024
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
fixed in 5.1.2
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.