porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Security advisories for PHP and JavaScript packages.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

15 JUN

HIGH7.5
vite-plus npm

vite: `server.fs.deny` bypass on Windows alternate paths

fixed in 0.1.24

HIGH7.5
vite npm

vite: `server.fs.deny` bypass on Windows alternate paths

fixed in 7.3.5 · 8.0.16

11 JUN

CRITICAL9.8
mtdowling/jmespath.php composer

CompilerRuntime code injection via unescaped function names

fixed in 2.9.1

8 JUN

CRITICAL
phpoffice/phpspreadsheet composer

PHPSpreadsheet has a patch bypass for CVE-2026-34084

no fix yet

29 MAY

HIGH
verbb/formie composer

formie's unauthenticated front-end submission editing can overwrite existing submissions

fixed in 2.2.21 · 3.1.26

27 MAY

MODERATE
twig/twig composer

Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators

fixed in 3.27.0

MODERATE
twig/twig composer

Sandbox `__toString()` policy bypass via dynamic mapping keys

fixed in 3.27.0

UNRATED
twig/twig composer

Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders

fixed in 3.27.0

LOW
twig/twig composer

Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

fixed in 3.27.0

MODERATE
twig/twig composer

Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

fixed in 3.27.0

26 MAY

MODERATE
symfony/http-client composer

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

fixed in 5.4.53

MODERATE
symfony/routing composer

CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

fixed in 5.4.53 · 6.4.41 · 7.4.13 · 8.0.13

LOW
symfony/polyfill-intl-idn composer

CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

fixed in 1.38.1

MODERATE
symfony/http-foundation composer

CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

fixed in 6.4.41 · 7.4.13 · 8.0.13

25 MAY

MODERATE5.3
guzzlehttp/psr7 composer

Host confusion via authority reinterpretation

fixed in 2.10.2

MODERATE5.3
guzzlehttp/psr7 composer

CRLF injection via URI host component

fixed in 2.10.2

20 MAY

MODERATE
twig/twig composer

`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

fixed in 3.26.0

HIGH
twig/twig composer

Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

fixed in 3.26.0

HIGH
twig/twig composer

Possible sandbox bypass when using a source policy

fixed in 3.0.0 · 3.26.0

MODERATE
twig/twig composer

`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

fixed in 3.26.0

LOW
twig/twig composer

Sandbox property allowlist bypass via the `column` filter (array_column on objects)

fixed in 3.26.0

UNRATED
twig/twig composer

Sandbox does not protect against resource exhaustion

fixed in 3.26.0

HIGH
twig/twig composer

Sandbox property and method bypass via object-destructuring assignment

fixed in 3.26.0

LOW
twig/twig composer

XSS in profiler HtmlDumper via unescaped template and profile names

fixed in 3.26.0

CRITICAL
twig/twig composer

PHP code injection via `{% use %}` template name

fixed in 3.26.0

LOW
twig/twig composer

The `spaceless` filter implicitly marks its output as safe

fixed in 3.26.0

HIGH
twig/twig composer

Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

fixed in 3.26.0

LOW
symfony/dom-crawler composer

CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

MODERATE
symfony/cache composer

CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →