Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS30 AUG
CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
fixed in 5.4.54 · 6.4.45 · 7.4.18 · 8.1.6
18 AUG
Incorrect Ed25519 public key validation
fixed in 1.24.1 · 2.5.1
7 AUG
Craft CMS: Passkey login accepts replayed WebAuthn assertions
fixed in 5.10.5
6 AUG
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
fixed in 4.18.2 · 5.10.6
Craft CMS: Authenticated leak of secret environment variables
fixed in 4.18.2 · 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
fixed in 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
fixed in 4.18.1 · 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
fixed in 4.18.2 · 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
fixed in 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
fixed in 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
fixed in 4.18.3 · 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
fixed in 4.18.1 · 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
fixed in 4.18.2 · 5.10.6
league/commonmark: Denial of service via deeply nested XML output
fixed in 2.9.0
league/commonmark: Denial of service via colliding heading slugs
fixed in 2.9.0
league/commonmark: Denial of service via duplicate footnote definitions
fixed in 2.9.0
league/commonmark: Denial of service via adjacent inline attribute blocks
fixed in 2.9.0
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
fixed in 2.9.0
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
no fix yet
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
fixed in 5.74.3 · 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
fixed in 5.74.3 · 6.24.2
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
fixed in 5.74.1 · 6.24.0
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
fixed in 5.74.1 · 6.24.0
Statamic: Account takeover via OAuth email matching without email-verification check
fixed in 5.74.1 · 6.24.0
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
fixed in 5.74.1 · 6.24.0
5 AUG
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
no fix yet
3 AUG
Guzzle: Noncanonical host can bypass host-based checks
fixed in 7.15.2 · 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
fixed in 7.15.2 · 8.0.1
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
fixed in 8.5.23
29 JUL
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.