porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Security advisories for PHP and JavaScript packages.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

2 SEP 2020

HIGH8.8
symfony/http-kernel composer

CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient

fixed in 4.4.13 · 5.1.5

6 AUG 2020

CRITICAL
laravel/framework composer

Guard bypass in Eloquent models

fixed in 6.18.34 · 7.23.2

27 JUL 2020

MODERATE
laravel/framework composer

RCE vulnerability in "cookie" session driver

fixed in 6.18.31 · 7.22.4

16 JUN 2020

HIGH
amphp/http-client composer

Header leakage on cross-domain redirects

fixed in 4.4.0

28 APR 2020

UNRATED
nystudio107/craft-seomatic composer

SSTI Vulnerability

fixed in 3.3.0

30 MAR 2020

LOW4.3
symfony/http-foundation composer

CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header

fixed in 4.4.7 · 5.0.7

MODERATE5.4
symfony/error-handler composer

CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler

fixed in 4.4.4 · 5.0.4

13 MAR 2020

MODERATE
laravel/framework composer

XSS vulnerability in blade templating

fixed in 7.1.2

27 FEB 2020

MODERATE6.1
enshrined/svg-sanitize composer

Sanitizer bypass in svg-sanitizer

fixed in 0.13.1

13 JAN 2020

HIGH5.3
laravel/framework composer

Unexpected bindings in QueryBuilder

fixed in 6.20.11 · 7.30.2 · 8.22.1

8 JAN 2020

HIGH7.5
enshrined/svg-sanitize composer

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

fixed in 0.12.0

1 JAN 2020

CRITICAL9.8
sabberworm/php-css-parser composer

Code injection vulnerability in allSelectors()

fixed in 1.0.1 · 2.0.1 · 3.0.1 · 4.0.1 · 5.0.9 · 5.1.3 · 5.2.1 · 6.0.2 · 7.0.4 · 8.0.1 · 8.1.1 · 8.2.1 · 8.3.1

13 NOV 2019

CRITICAL9.8
symfony/cache composer

CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances

fixed in 3.4.35 · 4.2.12 · 4.3.8

CRITICAL9.8
symfony/var-exporter composer

CVE-2019-11325: Fix escaping of strings in VarExporter

fixed in 4.2.12 · 4.3.8

HIGH7.5
symfony/mime composer

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

fixed in 4.3.8

HIGH8.1
symfony/http-kernel composer

CVE-2019-18887: Use constant time comparison in UriSigner

fixed in 2.8.52 · 3.4.35 · 4.2.12 · 4.3.8

HIGH7.5
symfony/http-foundation composer

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

fixed in 2.8.52 · 3.4.35 · 4.2.12 · 4.3.8

1 JUL 2019

HIGH8.8
phpoffice/phpspreadsheet composer

XXE Vulnerability

fixed in 1.8.0

16 APR 2019

HIGH7.1
symfony/cache composer

CVE-2019-10912: Prevent destructors with side-effects from being unserialized

fixed in 3.4.26 · 4.1.12 · 4.2.7

CRITICAL9.8
symfony/http-foundation composer

CVE-2019-10913: Reject invalid HTTP method overrides

fixed in 2.7.51 · 2.8.50 · 3.4.26 · 4.1.12 · 4.2.7

21 MAR 2019

MODERATE6.1
league/commonmark composer

XSS vulnerability with double-encoded entities

fixed in 0.18.3

12 MAR 2019

LOW3.7
twig/twig composer

Sandbox Information Disclosure

fixed in 1.38.0 · 2.7.0

29 DEC 2018

MODERATE6.1
league/commonmark composer

XSS vulnerability with unsafe link protocols

fixed in 0.18.1

20 NOV 2018

HIGH8.8
phpoffice/phpspreadsheet composer

XXE Vulnerability

fixed in 1.5.1

8 AUG 2018

HIGH
laravel/framework composer

Cookie serialization vulnerability

fixed in 5.5.42 · 5.6.30

1 AUG 2018

MODERATE6.5
symfony/http-foundation composer

CVE-2018-14773: Remove support for legacy and risky HTTP headers

fixed in 2.7.49 · 2.8.44 · 3.3.18 · 3.4.14 · 4.0.14 · 4.1.3

25 MAY 2018

MODERATE5.9
symfony/http-foundation composer

CVE-2018-11386: Denial of service when using PDOSessionHandler

fixed in 2.7.48 · 2.8.41 · 3.3.17 · 3.4.11 · 4.0.11

30 MAR 2018

HIGH
laravel/framework composer

Exploit of encryption failure vulnerability

fixed in 5.5.40 · 5.6.15

20 MAR 2018

UNRATED9.8
yiisoft/yii2 composer

Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`

fixed in 2.0.12.1 · 2.0.13.2 · 2.0.15

15 MAR 2018

MODERATE
amphp/http composer

Incorrect header injection check

fixed in 1.0.1

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →