porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Security advisories for PHP and JavaScript packages.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

13 MAY 2022

HIGH8.8
statamic/cms composer

Statamic framework Incorrect Permission Assignment

fixed in 2.6.0

10 MAY 2022

HIGH8.8
craftcms/cms composer

Improper account password reset in Craft CMS

fixed in 3.7.36

1 MAY 2022

MODERATE6.1
ezyang/htmlpurifier composer

HTML Purifier Cross-site Scripting vulnerability

fixed in 2.0.1

5 APR 2022

LOW
craftcms/cms composer

XSS Injection Vulnerability

fixed in 3.7.29

4 APR 2022

MODERATE6.1
craftcms/cms composer

Cross-site Scripting in craftcms/cms

fixed in 3.7.29

30 MAR 2022

CRITICAL9.1
firebase/php-jwt composer

Key/algorithm type confusion

fixed in 6.0.0

29 MAR 2022

LOW3.7
statamic/cms composer

Discoverability of user password hash in Statamic CMS

fixed in 3.2.39 · 3.3.2

24 MAR 2022

CRITICAL9.8
dompdf/dompdf composer

Remote code injection via remote fonts

fixed in 1.2.1

20 MAR 2022

MODERATE5.3
guzzlehttp/psr7 composer

Inproper parsing of HTTP headers

fixed in 1.8.4 · 2.1.1

18 MAR 2022

MODERATE6.1
craftcms/cms composer

Craft CMS Cross-site Scripting Vulnerability

fixed in 3.6.13

12 MAR 2022

HIGH9.8
nystudio107/craft-seomatic composer

Server-side Template Injection in nystudio107/craft-seomatic

fixed in 3.4.12

15 FEB 2022

MODERATE6.2
enshrined/svg-sanitize composer

A cross-site scripting vulnerability

fixed in 0.15.0

4 FEB 2022

HIGH8.8
twig/twig composer

Disallow non closures in the sort filter

fixed in 2.14.11 · 3.3.8

6 JAN 2022

HIGH8.8
laravel/framework composer

OS Command Injection in Laravel Framework

fixed in 5.8.17

18 NOV 2021

UNRATED9.8
laravel/framework composer

Image upload bypass

fixed in 8.71.0

15 NOV 2021

MODERATE6.5
symfony/serializer composer

CVE-2021-41270: Prevent CSV Injection via formulas

fixed in 4.4.35 · 5.3.12

18 OCT 2021

HIGH8.8
craftcms/cms composer

CSV Injection Vulnerability

fixed in 3.7.14

9 OCT 2021

MODERATE6.5
symfony/http-kernel composer

CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

fixed in 5.3.12

4 OCT 2021

MODERATE6.1
james-heinrich/getid3 composer

Cross-site scripting in demos/demo.mysqli.php in getID3

fixed in 1.9.21

28 SEP 2021

MODERATE4.4
lcobucci/jwt composer

CVE-2021-41106: File reference keys leads to incorrect hashes on HMAC algorithms

fixed in 3.4.6 · 4.0.4 · 4.1.5

2 JUL 2021

CRITICAL9.8
craftcms/cms composer

Craft CMS Remote Code Injection

fixed in 3.6.7

MODERATE6.1
craftcms/cms composer

Craft CMS Cross-site Scripting Vulnerability

fixed in 3.6.0

23 JUN 2021

CRITICAL9.8
league/flysystem composer

TOCTOU Race Condition enabling remote code execution

fixed in 1.1.4 · 2.1.1

6 MAY 2021

HIGH7.5
laravel/framework composer

Improper Input Validation in Laravel

fixed in 6.18.35 · 7.24.0

28 APR 2021

MODERATE
laravel/framework composer

SQL Server LIMIT / OFFSET SQL Injection

fixed in 6.20.26 · 7.30.5 · 8.40.0

21 JAN 2021

HIGH7.2
laravel/framework composer

Unexpected bindings in QueryBuilder

fixed in 6.20.14 · 7.30.4 · 8.24.0

1 JAN 2021

MODERATE6.1
laravel/framework composer

Possible cross-site scripting (XSS) vulnerability in the Blade templating engine

fixed in 6.20.42 · 7.30.6 · 8.75.0

31 DEC 2020

MODERATE6.4
phpoffice/phpspreadsheet composer

XSS Vulnerability in HTML Writer

fixed in 1.16.0

22 SEP 2020

MODERATE
livewire/livewire composer

$this->validate() returns all properties, not just validated ones

fixed in 2.2.6

14 SEP 2020

HIGH10.0
yiisoft/yii2 composer

Possible remote code execution via unserialize() on user input containing specially crafted string

fixed in 2.0.38

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →