Packagist

GHSA-5gmm-hjfj-8ff7

Packagist/paymenter/paymenter

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) yesterday

Fix available
Severity - 6.5 (Medium)

GHSA-jr78-w6w5-m8f8

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks yesterday

Fix available
Severity - 7.3 (High)

GHSA-9rcc-pmj8-ffhr

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-cx86-7xwp-w9wf

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-q5fm-9mx6-44f4

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-hw3m-8j5x-94ff

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki has an open redirect in Special:URIResolver yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-7xv3-gf2g-498h

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-59xw-qv23-j3rc

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-3jp5-3h47-28qf

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki has reflected XSS in Special:Ask plain table headers yesterday

Fix available
Severity - 6.1 (Medium)

GHSA-hg8h-557g-q8pp

Packagist/mediawiki/semantic-media-wiki

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes yesterday

Fix available
Severity - 8.6 (High)

GHSA-r94f-hx44-8jqf

Packagist/getgrav/grav

Grav CMS vulnerable to remote code execution via .zip file upload 2 days ago

Fix available
Severity - 8.7 (High)

GHSA-xhfv-7758-r9hx

Packagist/getgrav/grav

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin 2 days ago

Fix available
Severity - 7.7 (High)

GHSA-q2j8-x8hf-63ch

Packagist/getgrav/grav

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate 2 days ago

Fix available
Severity - 5.1 (Medium)

GHSA-f8wv-xp27-6gq7

Packagist/getgrav/grav

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write 2 days ago

Fix available
Severity - 9.3 (Critical)

GHSA-vfmf-q6x9-cw96

Packagist/getgrav/grav

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS 2 days ago

Fix available
Severity - 9.3 (Critical)

GHSA-4v9q-p283-qc2m

Packagist/getgrav/grav

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) 2 days ago

Fix available
Severity - 8.2 (High)

Vulnerabilities