Skip to content
OpenAdvisories

Ecosystem

Packagist

7,190 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,180 results · Feed

  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Low 3.3
    CVE-2026-118568

    Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    Drupal Content Sync (content-sync.io) drupal/cms_content_sync Packagist
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Medium 5.4
    CVE-2026-119193

    PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and …

    sebastianbergmann phpunit phpunit/phpunit phpunit Debian Packagist
  • High 8.8
    CVE-2026-56828

    Shopper: read-only team permissions allow administrator creation and permission escalation

    Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate …

    shopperlabs shopper shopper/framework Packagist
  • High 8.5
    CVE-2026-116675

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

    TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during pr…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  • Medium 4.1
    CVE-2026-117538

    REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

    REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a …

    redaxo core redaxo/source Packagist
  • Medium 4.1
    CVE-2026-117537

    REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

    REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML pa…

    redaxo core redaxo/source Packagist
  • High 7.3
    CVE-2026-116890

    Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

    Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read intern…

    Semantic MediaWiki SemanticMediaWiki mediawiki/semantic-media-wiki Packagist
  • Medium 6.1
    CVE-2026-116891

    SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

    SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 …

    Semantic MediaWiki SemanticMediaWiki mediawiki/semantic-media-wiki Packagist
  • Medium 6.5
    GHSA-mhf7-xp6r-6qrc

    Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    ### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while t…

    livewire/livewire Packagist
  • High 8.8
    CVE-2026-108357

    PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • High 8.7
    CVE-2026-108359

    PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • High 8.8
    CVE-2026-108358

    PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-by…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Medium 6.4
    CVE-2026-108360 Public exploit

    PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is e…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Medium 4.2
    CVE-2026-84910

    Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

    Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

    Drupal Advanced Search drupal/advanced_search Packagist
  • Low 3.1
    CVE-2026-84911

    AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.6
    CVE-2026-84913

    AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

    Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

    Drupal AI Translate drupal/ai_translate Packagist
  • Medium 4.6
    CVE-2026-84912

    AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.3
    CVE-2026-84914

    Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

    Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

    Drupal Calculate Working Days drupal/calculate_working_days Packagist
  • Medium 4.6
    CVE-2026-84915

    Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

    Drupal Component blocks drupal/component_blocks Packagist
  • Medium 6.5
    CVE-2026-84923

    Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from …

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 5.4
    CVE-2026-84924

    Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verifica…

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 6.5
    CVE-2026-84917

    Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

    Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

    Drupal Jsonapi Role Access drupal/jsonapi_role_access Packagist
  • Low 3.7
    CVE-2026-84916

    Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

    Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

    Drupal Islandora drupal/islandora Packagist
  • Low 3.8
    CVE-2026-16648

    Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

    Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

    Drupal Mailer Plus Log drupal/symfony_mailer_log Packagist
  • Medium 5.4
    CVE-2026-81163

    Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

    Drupal Media Library Importer drupal/media_library_importer Packagist
  • Low 3.7
    CVE-2026-84918

    Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

    Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

    Drupal Monobank payment API drupal/monobank Packagist
  • Medium 4.6
    CVE-2026-84919

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery ve…

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist
  • Medium 5.3
    CVE-2026-84920

    Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

    Drupal Unpublished Node Permissions drupal/unpublished_node_permissions Packagist
  • Medium 5.3
    CVE-2026-84921

    Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

    Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

    Drupal Webform Submissions Delete drupal/webform_submissions_delete Packagist
  • Medium 6.5
    CVE-2026-87936

    amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.…

    Drupal amazee.ai Private AI Provider drupal/ai_provider_amazeeio Packagist
  • Medium 6.5
    CVE-2026-87937

    Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2…

    Drupal Central Authentication System (CAS) Server drupal/cas_server Packagist