Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS20 MAY
CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
fixed in 5.4.52 · 6.4.40 · 7.4.12 · 8.0.12
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
fixed in 7.4.12 · 8.0.12
19 MAY
Laravel CRLF injection in default email rule
fixed in 12.60.0 · 13.10.0
18 MAY
Formie: Pre-authenticated server-side template injection in Hidden fields
fixed in 2.2.20 · 3.1.24
Statamic CMS: Server-Side Request Forgery via Glide
fixed in 5.73.22 · 6.18.1
11 MAY
Yii 2: Local file inclusion via view parameter name collision
fixed in 2.0.55
6 MAY
Statamic CMS vulnerable to email enumeration via forgot password endpoint
fixed in 5.73.21 · 6.15.0
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
fixed in 5.9.18
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
fixed in 4.17.12 · 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
fixed in 4.17.12 · 5.9.18
5 MAY
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
no fix yet
4 MAY
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
fixed in 15.32.2
29 APR
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
no fix yet
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
no fix yet
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
no fix yet
28 APR
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
no fix yet
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
no fix yet
24 APR
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
fixed in 8.5.10
22 APR
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
fixed in 12.5.22 · 13.1.6
20 APR
Cross-site scripting (XSS) via script break-out in toScript() output
fixed in 3.23.2 · 4.0.2
17 APR
Argument injection via newline in PHP INI values forwarded to child processes
fixed in 12.5.22 · 13.1.6
16 APR
Statamic: Unsafe method invocation via query value resolution allows data destruction
fixed in 5.73.20 · 6.13.0
14 APR
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
no fix yet
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
no fix yet
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
fixed in 5.9.15
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.