Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS29 AUG 2024
XXE in PHPSpreadsheet encoding is returned
fixed in 1.29.1 · 2.1.1 · 2.2.1
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
fixed in 1.29.1 · 2.1.0
25 JUL 2024
15 JUL 2024
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
fixed in 4.9.0
25 JUN 2024
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
no fix yet
4 JUN 2024
2 JUN 2024
Password confirmation stored in plain text via registration form in statamic/cms
fixed in 5.6.2
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
fixed in 2.0.49.4
20 MAY 2024
verbb/formie Server-Side Template Injection for variable-enabled settings
fixed in 2.1.6
15 MAY 2024
Laravel Hijacked authentication cookies vulnerability
fixed in 4.1.26
amphp/http-client Header leakage on cross-domain redirects
fixed in 4.4.0
19 MAR 2024
22 FEB 2024
Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE
fixed in 0.5.2
21 FEB 2024
php-svg-lib lacks path validation on font through SVG inline styles
fixed in 0.5.2
1 FEB 2024
Statmic CMS vulnerable to account takeover via XSS and password reset link
fixed in 3.4.17 · 4.46.0
30 JAN 2024
3 JAN 2024
1 JAN 2024
13 DEC 2023
Denial of service caused by infinite recursion when parsing SVG document
fixed in 0.5.1
12 DEC 2023
Denial of service caused by infinite recursion when parsing SVG images
fixed in 2.0.4
23 NOV 2023
22 NOV 2023
Potential URI resolution path traversal in the AWS SDK for PHP
fixed in 3.288.1
14 NOV 2023
Statamic CMS vulnerable to remote code execution via form uploads
fixed in 3.4.14 · 4.34.0
12 NOV 2023
Statamic CMS remote code execution via front-end form uploads
fixed in 3.4.13 · 4.33.0
13 SEP 2023
21 AUG 2023
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
no fix yet
6 JUL 2023
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
fixed in 4.10.0
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.