porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Security advisories for PHP and JavaScript packages.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

13 JUN 2022

MODERATE6.1
nystudio107/craft-seomatic composer

Cross-site Scripting in SEOmatic plugin

fixed in 3.4.11

CRITICAL9.8
nystudio107/craft-seomatic composer

Code Injection in SEOmatic

fixed in 3.4.11

9 JUN 2022

HIGH7.5
guzzlehttp/guzzle composer

Failure to strip the Cookie header on change in host or HTTP downgrade

fixed in 6.5.7 · 7.4.4

HIGH7.5
guzzlehttp/guzzle composer

Fix failure to strip Authorization header on HTTP downgrade

fixed in 6.5.7 · 7.4.4

25 MAY 2022

HIGH8.0
guzzlehttp/guzzle composer

Cross-domain cookie leakage

fixed in 6.5.6 · 7.4.3

24 MAY 2022

MODERATE5.4
craftcms/cms composer

Craft CMS Cross-site Scripting Vulnerability

fixed in 3.1.33

MODERATE5.3
spatie/browsershot composer

browsershot local file inclusion vulnerability

fixed in 3.40.1

HIGH7.5
nystudio107/craft-seomatic composer

SEOmatic for CraftCMS allows Server-Side Template Injection

fixed in 3.2.49

CRITICAL9.8
nystudio107/craft-seomatic composer

SEOmatic for CraftCMS allows Server-Side Template Injection

fixed in 3.3.0

CRITICAL9.8
mikehaertl/php-shellcommand composer

php-shellcommand command injection vulnerability

fixed in 1.6.1

CRITICAL9.8
craftcms/cms composer

Craft CMS possibility of brute force attempts

fixed in 3.1.7

MODERATE6.1
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 3.3.8

MODERATE6.1
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 3.1.31

17 MAY 2022

MODERATE5.3
ezyang/htmlpurifier composer

HTML Purifier allows remote attackers to obtain sensitive information

no fix yet

MODERATE6.1
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 2.6.2974

MODERATE6.1
yiisoft/yii2 composer

Yii Framework Reflected XSS

fixed in 2.0.11

MODERATE6.1
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 2.6.2976

MODERATE5.3
craftcms/cms composer

Craft CMS subject to URL forgery

fixed in 2.6.2976

MODERATE6.1
laravel/laravel composer

Laravel does not properly constrain the host portion of a password-reset URL

fixed in 5.4.22

MODERATE6.1
yiisoft/yii2 composer

Yii Cross-site Scripting Framework vulnerability

no fix yet

MODERATE5.4
craftcms/cms composer

Craft CMS XSS Vulnerability

fixed in 2.6.2982

MODERATE6.1
filp/whoops composer

filp whoops Cross-site Scripting vulnerability

fixed in 2.1.13

14 MAY 2022

MODERATE5.9
yiisoft/yii2 composer

Yii Incorrectly Implements CORS

fixed in 2.0.16

CRITICAL9.8
laravel/framework composer

Laravel Framework Deserialization Vulnerability

fixed in 6.20.44

MODERATE4.8
craftcms/cms composer

Craft CMS Cross-site Scripting (XSS) Vulnerability

no fix yet

HIGH8.1
laravel/framework composer

Laravel Framework RCE Vulnerability

no fix yet

13 MAY 2022

HIGH7.2
craftcms/cms composer

Craft CMS Vulnerable to Server-Side Template Injection

no fix yet

MODERATE5.3
craftcms/cms composer

Craft CMS Unauthorized View

fixed in 2.6.2976

HIGH8.8
craftcms/cms composer

Craft CMS PHP Code Injection Vulnerability

no fix yet

HIGH7.5
nystudio107/craft-seomatic composer

SEOmatic plugin for Craft CMS SSTI Vulnerability

fixed in 3.1.4

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →