OSV - Open Source Vulnerabilities

GHSA-rjhh-76wf-8xmw

Packagist/smarty/smarty

Smarty Security stream restriction bypass through stream: resource

1 hour ago

Fix available
Severity - 6.9 (Medium)

GHSA-f6wf-28g6-769x

Packagist/smarty/smarty

Smarty: Symlink path traversal out of trusted directories

1 hour ago

Fix available
Severity - 6.9 (Medium)

GHSA-wg23-69c2-gjc8

Packagist/craftcms/cms

Craft CMS: Passkey login accepts replayed WebAuthn assertions

1 hour ago

Fix available
Severity - 9.1 (Critical)

GHSA-957r-qf9p-67xw

Packagist/craftcms/cms

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

18 hours ago

Fix available
Severity - 6.9 (Medium)

GHSA-596p-6jv8-775v

Packagist/craftcms/cms

Craft CMS: Authenticated leak of secret environment variables

18 hours ago

Fix available
Severity - 5.1 (Medium)

GHSA-xxpx-f366-4xpq

Packagist/craftcms/cms

Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

18 hours ago

Fix available

GHSA-rvmm-v933-jgxq

Packagist/craftcms/cms

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

18 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-7hxc-f267-h5q7

Packagist/craftcms/cms

Craft CMS: Incorrect path validation could potentially lead to path traversal

18 hours ago

Fix available
Severity - 2.1 (Low)

GHSA-2rp4-x2j7-qmcc

Packagist/craftcms/cms

Craft CMS: Stored XSS in the control panel via unescaped draft name

18 hours ago

Fix available
Severity - 5.1 (Medium)

GHSA-hmqg-cxww-wqhq

Packagist/squizlabs/php_codesniffer

PHP_CodeSniffer gitblame report command injection via crafted filename

18 hours ago

Fix available
Severity - 7.3 (High)

GHSA-p8x7-9vfw-p7vc

Packagist/craftcms/cms

Craft CMS: Arbitrary user password reset leading to administrator account takeover

19 hours ago

Fix available

GHSA-f5wm-88jv-g5hx

Packagist/craftcms/cms

Craft CMS: Authenticated RCE through Twig sandbox escape

19 hours ago

Fix available
Severity - 8.7 (High)

GHSA-9p7c-v5x3-rfx8

Packagist/craftcms/cms

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

19 hours ago

Fix available

GHSA-265m-7826-wjqm

Packagist/craftcms/cms

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

19 hours ago

Fix available
Severity - 8.7 (High)

GHSA-mj63-m3rc-8ppr

Packagist/league/commonmark

league/commonmark: Denial of service via deeply nested XML output

19 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-mh25-x5hq-wrqp

Packagist/league/commonmark

league/commonmark: Denial of service via colliding heading slugs

19 hours ago

Fix available
Severity - 7.5 (High)