Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that exe…

▾ Twilightcachethq · cachetEPSS 0.46%via CVEORG

CVE-2026-104827High· 7.5

1w ago

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without…

▾ Twilightreactphp · httpEPSS 0.43%via NVD

CVE-2026-62858Medium· 5.3PoC

1w ago

YOURLS is a self-hosted, customizable URL shortener written in PHP

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash tra…

▾ TwilightYOURLS · YOURLSEPSS 0.47%via NVD

CVE-2026-107381Medium· 6.5PoC

1w ago

svg-sanitizer is a PHP SVG/XML sanitizer

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes()…

▾ Twilightenshrined · enshrined/svg-sanitizeEPSS 0.47%via NVD

CVE-2026-85990High· 8.8PoC

2w ago

Leantime is an open source project management system

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public…

▾ MidnightLeantime · leantimeEPSS 0.33%via NVD

CVE-2026-56826Medium· 5.4PoC

2w ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because package…

▾ Twilightshopper · shopper/frameworkEPSS 0.28%via NVD

CVE-2026-65954High· 8.6

2w ago

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with…

▾ Twilightphpcsstandards · phpcsstandards/phpcsutilsEPSS 0.21%via NVD

CVE-2026-107851Medium· 4.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the…

▾ Sunlitcontao · contao/core-bundleEPSS 0.19%via NVD

CVE-2026-107850Medium· 4.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is Preview…

▾ Sunlitcontao · contao/core-bundleEPSS 0.19%via NVD

CVE-2026-107848Low· 3.5

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions di…

▾ Sunlitcontao · contao/core-bundleEPSS 0.11%via NVD

CVE-2026-107845Critical· 9.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comm…

▾ Midnightcontao · contao/comments-bundleEPSS 0.28%via NVD

CVE-2026-107844Medium· 5.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verif…

▾ Sunlitcontao · contao/core-bundleEPSS 0.31%via NVD

CVE-2026-107843Medium· 5.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or th…

▾ Sunlitcontao · contao/core-bundleEPSS 0.27%via NVD

CVE-2026-107842Medium· 5.3

2w ago

Contao is an Open Source CMS

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from …

▾ Sunlitcontao · contao/core-bundleEPSS 0.26%via NVD

CVE-2026-107380Medium· 5.4

2w ago

savg-sanitizer is a PHP SVG/XML sanitizer

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration.…

▾ Sunlitdarylldoyle · svg-sanitizerEPSS 0.25%via NVD

CVE-2026-107379Medium· 6.5PoC

2w ago

savg-sanitizer is a PHP SVG/XML sanitizer

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attrib…

▾ Twilightdarylldoyle · svg-sanitizerEPSS 0.53%via NVD

CVE-2026-104890High· 7.2

3w ago

Kunstmaan CMS is an open source content management system based on the Symfony framework

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::ge…

▾ TwilightKunstmaan · KunstmaanBundlesCMSEPSS 0.42%via NVD

CVE-2026-104181Medium· 5.4

3w ago

Filament is a collection of full-stack components for accelerated Laravel development

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current pa…

▾ Sunlitfilamentphp · filamentEPSS 0.35%via NVD

GHSA-3q6v-r5mr-hxv8High· 7.5

3w ago

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

▾ Twilightleague · league/commonmarkvia GHSA

GHSA-97jj-33gv-5xf9Medium· 6.1

3w ago

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

▾ Sunlitleague · league/commonmarkvia GHSA

CVE-2026-55224High· 8.7PoC

3w ago

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to versi…

▾ Midnightmineadmin · MineAdminEPSS 1.2%via NVD

CVE-2026-102601Low· 3.5PoC

4w ago

Flysystem is an open source file storage library for PHP

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both f…

▾ Twilightthephpleague · flysystemEPSS 0.34%via NVD