marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ad20405fc2dfcdbea735195261bb7e4909beb8b8
Open_Ultra_SAST/benchmarks/independent/research-2026-09-30-php.md
T
Marius CiepluchandClaude Opus 5.5 d86ba281ec bench(independent): reserve population v3 (PHP, 16 cases) by rule 
Maintainer's selection 2026-09-30, "Recommended 16, minus v2 mentions": the
research's rule-based 16 with Winter, elFinder and Easy!Appointments replaced
by the next candidate in their family by the same rule (named fix first, then
newest first), v2-mentioned alternates (Grav, Backpack CRUD, Koel) skipped.
Winter -> mantisbt-tokenizer-eval-rce; elFinder -> pagible (inferred fix, to
be confirmed at freeze); Easy!Appointments -> empty slot (no remaining
untrusted_destination candidate), so 15 cases are reserved.

The reservation guard now covers v3: all six families, a declared-language
population, status "reserved".

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
2026-09-30 18:03:07 +02:00

171 KiB
Raw Blame History

Independent evaluation population v3 (PHP): candidate real-world cases

Research date: 2026-09-30. Method: web research only. I read GitHub advisory records (the global advisory API, reviewed and unreviewed), commit pages, compare views, repository metadata and file histories through gh api (read-only) and GitHub search. I did not clone, download or check out any candidate repository, did not run any scanner, rule, engine or project tool on one, and did not read candidate source beyond what an advisory itself quotes. Commit pages were read for their metadata (parents, message, changed-file names and line counts), not their patch text.

Output: this file and candidates-v3-php.json (26 candidates, machine-readable, one record per case in the v2 schema plus research fields). Nothing is reserved yet: the maintainer chooses, then a population-v3.toml and a protocol are written and frozen as for v2.

Why a v3, and what it must not contain

PHP quick-mode rules were written on 2026-09-30 while looking at PMPro, population-v1's PHP cases, Ultimate Member, MediaWiki and WP Statistics. None of today's PHP numbers qualifies, and population v2 is reserved for other qualification. v3 must be PHP cases nobody in this project has looked at.

Selection criteria (fixed before looking at any advisory)

From the maintainer's brief, unchanged:

  • Language PHP. WordPress plugins allowed but capped at half the population; non-WordPress PHP applications and frameworks included.
  • Recency: advisory published 2026-06-01 or later, taken newest first; a public fix commit or tag diff in a public GitHub repository; identifiable vulnerable and fixed versions.
  • Family spread: at most about 40% injection; include output_encoding, path, untrusted_destination, deserialization, access_control and OS command injection where advisories exist. Families are the ids of src/openultrasast/ruleset/families.toml, and an advisory's family is found from its CWE ids through that file's cwes lists (so CWE-434 upload and CWE-74 generic injection map to no family).
  • Declarable site: the advisory names the vulnerable function or file, so a sites entry can be declared from its text alone.
  • Exclusions: any repository whose github.com/owner/repo appears under benchmarks/, src/, tests/ or .kiro/ (341 repositories, extracted by grep and compared case-insensitively); PMPro, Ultimate Member, LearnPress, phpMyFAQ, YesWiki, MediaWiki (including MediaWiki extensions), WP Statistics, froxlor, GoPay, Directorist and Groundhogg by name; repositories over about 150 MB by the GitHub API size (153,600 KB); advisories without a fix diff.

Operational rules, carried over from the v2 research (research-2026-09-26.md) and fixed before the first advisory was read:

  • In scope means a web application, CMS, web framework/bundle or plugin whose vulnerable code is reached from HTTP request handling inside the repository. General-purpose libraries and framework APIs whose attacker input only exists in a calling application, developer tools/CLIs, and client-side JavaScript sinks are rejected (they give the analyzer no in-repo source).
  • Fix: at most 3 commits, or one commit that is plainly about this weakness; a fix buried in a large unrelated squash or release commit is rejected, as is a fix that changes no PHP line (the fixed pin must differ in PHP). A fix commit the advisory does not name may be taken from the release compare or the named file's history, and is then marked fix_named_by_advisory: false.
  • One case per repository. Old vulnerabilities republished in 2026 under an older CVE id are rejected (v2 did the same).
  • Guard-bypass and incomplete-fix advisories are allowed, with the caveat recorded.
  • At no point was a case chosen or skipped for how easy it would be for this analyzer. No rule or query of the project was consulted.

Order and quotas

  • Family quotas (targeting about 27 candidates): injection 8, output_encoding 4, path 4, untrusted_destination 4, access_control 4, deserialization 3.
  • Passes by family, rarest first, so that one-case-per-repository does not hand a rare family's only repository to a common family. Rarity was counted from metadata alone (distinct eligible repositories per family after the automatic exclusions, before any advisory text was read): deserialization 1, injection 9, path 10, untrusted_destination 11, access_control 16, output_encoding 21. Within a pass, advisories are taken newest first (by published_at); a repository taken in an earlier pass is skipped.
  • Sources (lanes), consulted in this order within a pass, and each later lane only for a family still short after the earlier ones:
    • Lane A — reviewed GitHub advisories, ecosystem composer, published >= 2026-06-01 (582 records; 386 in the six families). gh api --paginate "/advisories?ecosystem=composer&type=reviewed&published=>=2026-06-01&sort=published&direction=desc".
    • Lane B — unreviewed advisories for the family CWEs of injection, path, deserialization and untrusted_destination (5,246 records), kept when a reference is a github.com/<o>/<r>/(commit|pull|compare)/ link and the GitHub API reports the repository's language as PHP (92 records on 56 PHP repositories). Output_encoding and access_control were not fetched, because lane A filled them.
    • Lane C — deserialization only: unreviewed CWE-502 advisories whose text names WordPress (42), each plugin searched on GitHub for a development repository (SVN mirrors do not count, as in v2), plus the non-WordPress CWE-502 records naming a PHP product (9). The Patchstack one-line records ('Unauthenticated PHP Object Injection in X <= v') never name a function and were not examined individually.
    • Lanes B and C were added after lane A left injection 4, path 3 and deserialization 0 against their quotas; the lane rule was fixed then, before any lane-B/C advisory was read.
  • Verification of every candidate: gh api repos/O/R/commits/<sha> for the fixed commit (parents, message, changed files); the vulnerable pin is the fixed commit's (first) parent, except where a short linear chain is noted; compare/<fixed>...<release tag> confirms the fixed commit is an ancestor of the first fixed release wherever a tag exists; repository size, licence and default branch from repos/O/R.

Counts

  • Examined: 470 advisories (lane A 379, lane B 40, lane C 51). Taken: 26. Rejected: 444.
  • Automatic exclusions by metadata count as examined, as in v2; advisories passed over after their family's quota filled were not examined and are listed separately (lane A 7, lane B 34; lane B's 18 untrusted_destination rows were never needed).
Rejection reason Count
repository over ~150 MB 161
one case per repository 64
repository already referenced in the project tree (used list) 46
advisory names no vulnerable file or function 46
library/framework API: no attacker source inside the repository 42
duplicate advisory 26
no usable fix diff (none, unmerged, reverted, release squash, or non-PHP) 25
no public development repository 10
not a web application (developer tool, CLI, game server) 9
excluded by name 6
old vulnerability republished (CVE-2022..2025) 4
sink is client-side JavaScript 3
other: corrupt advisory record: the description is about draytek vi 1
other: personal/student project (`harsh21patel/inventory-management 1

Family mix of the 26 candidates

Family Candidates Of which WordPress Subtypes
injection 8 0 OS command / argument injection; OS command injection; SQL injection; code injection
output_encoding 4 0 XSS; reflected JSON injection; stored HTML injection; stored XSS
path 4 1 local file inclusion; path traversal
untrusted_destination 4 0 SSRF
access_control 4 2 IDOR; IDOR in REST permission callback; missing object-level capability check; unvalidated URL-writable properties override provisioning parameters
deserialization 2 2 PHP object injection; PHP object injection → arbitrary file deletion
total 26 5 (19%)

Injection is 8 of 26 (31%): SQL 2 (Winter, QloApps), OS command 3 (Backpack, GitList, Roundcube), code/eval 3 (Grav, MantisBT, MacCMS). Untrusted_destination is all SSRF: no open-redirect advisory reached the top of its pass. WordPress is 5 of 26 (19%), under the cap.

Candidates

Full records (sink, source, sites, site derivation, fix notes, caveats, benign proposal) are in candidates-v3-php.json. R marks the recommended selection below.

# R id repo family advisory published vulnerable → fixed fixed release sites (advisory) licence MB WP
1 grav-blueprint-bare-function-rce https://github.com/getgrav/grav injection CVE-2026-75827 / GHSA-f8wv-xp27-6gq7 2026-09-17 24e8717ae317 → af31066e9b6a 2.0.15 system/src/Grav/Common/Data/Blueprint.php::isSafeDynamicCall, system/src/Grav/Common/Data/Blueprint.php::init MIT 34
2 backpack-stats-host-header-cmdi https://github.com/Laravel-Backpack/CRUD injection CVE-2026-54182 / GHSA-mrc5-3mm3-45c5 2026-08-20 baae0420b6eb → 282ba2a0b887 7.0.36 src/Stats.php::makeCurlRequest MIT 76
3 R winter-filter-numberrange-sqli https://github.com/wintercms/winter injection CVE-2026-32593 / GHSA-m7jc-g4rc-jmvh 2026-08-12 555e67c84b50 → 50713de95adf 1.2.13 modules/backend/widgets/Filter.php::numbersFromAjax MIT 68
4 mantisbt-tokenizer-eval-rce https://github.com/mantisbt/mantisbt injection CVE-2026-49273 / GHSA-v84x-qvhg-f36r 2026-07-15 e7041ecc80c8 → 78c0af63d1fe 2.28.4 file only: core/classes/Tokenizer.class.php, adm_config_set.php GitHub: none [verify] 89
5 R gitlist-commandline-cmdi https://github.com/klaussilveira/gitlist injection CVE-2026-82668 / GHSA-v64j-pgc3-qgc9 2026-08-31 f67609d52c18 → 88cf2866083d 3.0.0-beta src/SCM/System/Git/CommandLine.php::getDefaultBranch BSD-3-Clause 6
6 R qloapps-customermessage-bo-query-sqli https://github.com/Qloapps/QloApps injection CVE-2026-75497 / GHSA-5w6r-2mxc-fq3v 2026-08-25 5b4d65cbb857 → 123c97c110b7 commit 123c97c file only: classes/CustomerMessage.php OSL-3.0 129
7 R roundcube-markasjunk-cmd-learn-rce https://github.com/roundcube/roundcubemail injection CVE-2026-74997 / GHSA-q5rh-mmp4-ppgq 2026-08-17 a1afb8fd1f00 → b8f90e28a46d 1.6.18 / 1.7.3 file only: plugins/markasjunk/drivers/cmd_learn.php GPL-3.0 67
8 R maccms10-template-blacklist-rce https://github.com/magicblack/maccms10 injection CVE-2026-71232 / GHSA-cv48-22qx-mpmx 2026-08-05 2cabecda2994 → 71ad3bb29570 commit 71ad3bb file only: application/admin/controller/Template.php GitHub: NOASSERTION [verify] 29
9 R kirby-realpath-sibling-traversal https://github.com/getkirby/kirby path CVE-2026-75592 / GHSA-6j4c-mgqr-qv76 2026-09-02 e90257fd7504 → 2b6fab950bc8 4.9.5 / 5.5.2 src/Filesystem/Dir.php::realpath, src/Filesystem/F.php::realpath GitHub: NOASSERTION [verify] 66
10 R mineadmin-appstore-identifier-traversal https://github.com/mineadmin/MineAdmin path CVE-2026-55224 / GHSA-59xm-4m8c-g3xj 2026-08-18 ac0dcad616c5 → ca41902a2a54 3.2.0-alpha.2 plugin/mine-admin/app-store/src/Service/Service.php::download, plugin/mine-admin/app-store/src/Service/Service.php::install, plugin/mine-admin/app-store/src/Service/Service.php::unInstall Apache-2.0 53
11 facturascripts-uploadedfile-move-traversal https://github.com/NeoRazorX/facturascripts path GHSA-hgjx-r89m-m7v4 2026-07-14 6baefcdc00c2 → d3770be64a3e not stated Core/UploadedFile.php::move LGPL-3.0 60
12 R wp-geo-my-wp-info-window-lfi https://github.com/Fitoussi/geo-my-wp path CVE-2026-85200 / GHSA-6hw9-7gx5-mw88 2026-09-12 1dbb7b1672a4 → 5a768bf1c6e4 4.5.5.4 plugins/posts-locator/includes/gmw-posts-locator-functions.php::gmw_posts_locator_ajax_info_window_loader GitHub: none [verify] 9 yes
13 R elfinder-fsock-dns-rebinding-ssrf https://github.com/Studio-42/elFinder untrusted_destination CVE-2026-81889 / GHSA-8x3q-jpjh-qh5c 2026-08-31 dd73e702820c → 6d997386cd0f 2.1.70 php/elFinder.class.php::fsock_get_contents GitHub: NOASSERTION [verify] 43
14 R easyappointments-caldav-ssrf https://github.com/alextselegidis/easyappointments untrusted_destination CVE-2026-52840 / GHSA-pm5p-7w5h-jm5q 2026-07-29 725eafa64730 → 4abb10545d83 1.6.0 application/controllers/Caldav.php::connect_to_server, application/libraries/Caldav_sync.php::test_connection GPL-3.0 49
15 koel-podcast-enclosure-ipv6-ssrf https://github.com/koel/koel untrusted_destination CVE-2026-54494 / GHSA-rjg7-r26h-cfp2 2026-07-15 8ee1de0f5589 → 5f6ce2cefd08 9.7.1 app/Helpers/Network.php::isPublicHost, app/Values/Podcast/EpisodePlayable.php::createForEpisode MIT 29
16 pagible-admin-proxy-dns-rebinding-ssrf https://github.com/aimeos/pagible untrusted_destination CVE-2026-49262 / GHSA-mmj8-wcvw-6789 2026-06-26 03f03b2f81b2 → 09a8205d513e 0.10.4 admin/src/Controllers/AdminController.php::proxy, core/src/Utils.php::isValidUrl MIT 73
17 R wp-graphql-updatepost-publish-bypass https://github.com/wp-graphql/wp-graphql access_control CVE-2026-88974 / GHSA-5mmc-8pc9-wggg 2026-09-23 d53b0e566f20 → 55441663eaa3 2.22.2 file only: plugins/wp-graphql/src/Mutation/PostObjectUpdate.php GPL-3.0 120 yes
18 R sylius-mollie-thankyou-order-idor https://github.com/Sylius/MolliePlugin access_control CVE-2026-68501 / GHSA-x83g-979r-f5fh 2026-07-31 7400f1489a4b → 01316b3ad3cf 2.2.8 / 3.2.4 / 3.3.1 src/Controller/Shop/PageRedirectController.php::thankYouAction, src/Controller/Shop/QrCodeAction.php::fetchQrCodeFromOrder MIT 9
19 paymenter-checkout-config-override https://github.com/Paymenter/Paymenter access_control CVE-2026-47198 / GHSA-5q4q-834j-g8g4 2026-06-30 9d305ea444f7 → 75719ae46b40 1.5.1 file only: app/Livewire/Products/Checkout.php, app/Livewire/Cart.php MIT 15
20 wp-buddypress-messages-rest-idor https://github.com/buddypress/buddypress access_control CVE-2026-53673 / GHSA-j3j5-5m8v-7gvc 2026-06-10 56b1fd3b4054 → 27d41e9749a8 14.5.0 src/bp-messages/classes/class-bp-messages-rest-controller.php::get_item_permissions_check GitHub: none [verify] 79 yes
21 R sharp-editor-iframe-srcdoc-xss https://github.com/code16/sharp output_encoding CVE-2026-61823 / GHSA-qxg3-46rw-79j8 2026-09-25 677431493090 → ec509a22c808 9.22.5 file only: src/Utils/Sanitization/FormatsSanitizedValue.php MIT 109
22 R privatebin-jsonld-request-uri-injection https://github.com/PrivateBin/PrivateBin output_encoding CVE-2026-55891 / GHSA-xrjc-c68j-hp7w 2026-08-28 e0dd4c025c19 → 75f056dcda95 2.0.5 lib/Request.php::getRequestUri, lib/Controller.php::_jsonld GitHub: NOASSERTION [verify] 16
23 R openstamanager-group-name-html-injection https://github.com/devcode-it/openstamanager output_encoding CVE-2026-44701 / GHSA-crx4-7mmq-j74j 2026-08-26 57a2734e2121 → 0b88ad196387 2.11-beta modules/utenti/edit.php::<global> GPL-3.0 43
24 symfony-ux-live-child-tag-xss https://github.com/symfony/ux output_encoding CVE-2026-49210 / GHSA-38x5-rcv4-xf7x 2026-06-19 a6e9bf808476 → fbc5e9a1bda7 2.36.0 / 3.1.0 src/LiveComponent/src/Util/ChildComponentPartialRenderer.php::createHtml MIT 59
25 R wp-podlove-generation-guard-poi https://github.com/podlove/podlove-publisher deserialization CVE-2026-16099 / GHSA-q83h-6954-x259 2026-08-16 4eedbd667969 → ea878175f261 4.5.4 (not stated in the advisory; first release after the fix) lib/modules/shownotes/rest_api.php::create_link_item, lib/image_cache/generation_guard.php::__destruct MIT 33 yes
26 wp-admin-columns-ids-to-collection-poi https://github.com/codepress/admin-columns deserialization CVE-2026-7654 / GHSA-h6x4-229g-5f43 2026-06-06 ea6db9a02e01 → c64e9aaecd20 7.0.19 (not stated; first release after the fix) classes/Formatter/IdsToCollection.php::get_ids_from_string GPL-3.0 37 yes

Full SHAs are in the JSON. Fix commits the advisory does not name (inferred from a release compare or file history): grav, backpack, facturascripts, pagible, paymenter, podlove, admin-columns.

Per-candidate notes

grav-blueprint-bare-function-rce (injection; code injection (callable allow-list bypass → arbitrary PHP function))

  • Repo https://github.com/getgrav/grav (MIT, 34 MB, languages PHP 100%). Lane A. Advisory CVE-2026-75827 / GHSA-f8wv-xp27-6gq7, published 2026-09-17; affected <= 2.0.14; fixed 2.0.15.
  • Sink: system/src/Grav/Common/Data/Blueprint.php:455-458 call_user_func_array($o, $params) (bare-function dynamic-data provider), gated by Blueprint::isSafeDynamicCall() (Blueprint.php:514-536), whose bare-function branch uses only the denylist Utils::isDangerousFunction(); twin sink system/src/Grav/Framework/Flex/FlexDirectory.php:936-938 call_user_func_array($function, $params). Source: a blueprint data-*@ directive naming a bare PHP function (e.g. error_log) with attacker parameters, resolved by Blueprint::init(). Privilege: authenticated account that can edit pages/blueprint data (per the advisory's root-cause section; verify).
  • Fix: The advisory links no commit. Found in the release compare 2.0.14...2.0.15 (14 commits, each security fix labelled): af31066e '[security] Gate the blueprint bare-function data directive on a positive allowlist', 1 file (Blueprint.php +11-1). A later commit in the same release, c51987f5 'Trust blueprint dynamic-data providers by provenance, not by allowlist', reworks the same gate. Ancestry: parent; ancestor of tag 2.0.15.
  • Sites: file paths and function names quoted by the advisory. sink_evidence call_user_func_array($o, $params).
  • Benign: fixed pin as fixed-side control; proposed benign change 8661b3b56448 "Deduplicate repeated debugger deprecation traces" (172 lines, CHANGELOG.md, system/src/Grav/Common/Debugger.php, tests/unit/Grav/Common/DebuggerDeprecationsTest.php).
  • Caveats: guard bypass: the vulnerable pin already has a denylist check; the enclosing function of the call_user_func_array line is not named by this advisory (sink_evidence is used instead). Confidence: high.

backpack-stats-host-header-cmdi (injection; OS command injection)

  • Repo https://github.com/Laravel-Backpack/CRUD (MIT, 76 MB, languages PHP 80%, Blade 17%). Lane A. Advisory CVE-2026-54182 / GHSA-mrc5-3mm3-45c5, published 2026-08-20; affected 7.x < 7.0.36 (also 4.1.x < 4.1.72, 5.x < 5.6.2, 6.x < 6.8.13); fixed 7.0.36.
  • Sink: Backpack\CRUD\Stats::makeCurlRequest builds a shell command and passes it to exec(). Source: HTTP Host header, on every production request through BackpackServiceProvider::boot() (1-in-100 random gate). Privilege: unauthenticated.
  • Fix: The advisory links only release tags. The compare 7.0.35...7.0.36 contains exactly one commit, 282ba2a0 'refactor stats to use guzzle only' (src/Stats.php +6-31), matching the advisory's 'makeCurlRequest was replaced with the Guzzle-based path'. Ancestry: parent; the fixed commit is tag 7.0.36.
  • Sites: class and method named by the advisory; the path src/Stats.php follows from the PSR-4 class name and is confirmed only by the fix commit's file list.
  • Benign: fixed pin as fixed-side control; proposed benign change 608652b1020b "fix color display (#5992)" (8 lines, src/resources/views/crud/columns/color.blade.php).
  • Caveats: needs exec() and curl available, and a Host header that the web server passes through (the advisory rates AC:H). Confidence: high.

winter-filter-numberrange-sqli (injection; SQL injection)

  • Repo https://github.com/wintercms/winter (MIT, 68 MB, languages PHP 70%, JavaScript 19%, Less 8%). Lane A. Advisory CVE-2026-32593 / GHSA-m7jc-g4rc-jmvh, published 2026-08-12; affected <= 1.2.12; fixed 1.2.13.
  • Sink: Backend\Widgets\Filter builds SQL for a numberrange scope configured with a conditions key. Source: the filter widget's AJAX handler (numbersFromAjax, per the advisory title). Privilege: authenticated backend user with access to an affected list view.
  • Fix: Advisory workaround names commit 50713de9 'Use parameter binding for filter scope values in conditions statements' (modules/backend/widgets/Filter.php +64-24, plus a test). Ancestry: parent; ancestor of tag v1.2.13, not of v1.2.12.
  • Sites: class Backend\Widgets\Filter and numbersFromAjax named by the advisory; path confirmed by the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change 2a342f94ae7c "Improved Ukrainian translation (#1467)" (46 lines, modules/backend/lang/uk/lang.php).
  • Caveats: no built-in view uses the vulnerable scope/config combination: exploitable only with a plugin that registers a numberrange scope with conditions (the sink is in core, the configuration is not). Confidence: medium.

mantisbt-tokenizer-eval-rce (injection; code injection (eval))

  • Repo https://github.com/mantisbt/mantisbt (GitHub: none [verify], 89 MB, languages PHP 82%, CSS 10%). Lane A. Advisory CVE-2026-49273 / GHSA-v84x-qvhg-f36r, published 2026-07-15; affected >= 1.3.0, <= 2.28.3; fixed 2.28.4.
  • Sink: Tokenizer (reached through ConfigParser) calls eval() with a return; prefix; PHP hoists class declarations past the return. Source: non-string configuration value submitted to adm_config_set.php (Manage Configuration). Privilege: administrator.
  • Fix: Advisory patch link 78c0af63 'Remove use of eval() in Tokenizer class' (core/classes/Tokenizer.class.php +2-6). Ancestry: parent; ancestor of tag release-2.28.4.
  • Sites: the advisory names adm_config_set.php, ConfigParser, Tokenizer and eval(); the Tokenizer file path and the enclosing function are not named (path from the fix commit). sink_evidence eval(.
  • Benign: fixed pin as fixed-side control; proposed benign change c867fcc0c119 "Web UI: use project category commands" (58 lines, manage_proj_cat_add.php, manage_proj_cat_copy.php, manage_proj_cat_delete.php…).
  • Caveats: function-level site must be resolved at freeze by reading the file (the advisory names only the class). Confidence: high.

gitlist-commandline-cmdi (injection; OS command / argument injection)

  • Repo https://github.com/klaussilveira/gitlist (BSD-3-Clause, 6 MB, languages PHP 87%, Twig 9%). Lane B. Advisory CVE-2026-82668 / GHSA-v64j-pgc3-qgc9, published 2026-08-31; affected 2.0.0; fixed 3.0.0-beta.
  • Sink: getDefaultBranch of src/SCM/System/Git/CommandLine.php (git command line). Source: repository content/arguments reaching the git command line (not stated precisely). Privilege: not stated ('remotely').
  • Fix: Advisory names patch 88cf2866 'Prevent textconv. Fixes #947.' (src/SCM/System/Git/CommandLine.php +2-2, plus a test). Ancestry: parent; ancestor of tag 3.0.0-beta.
  • Sites: file and function quoted by the advisory (VulDB-generated text).
  • Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file).
  • Caveats: VulDB auto-generated description; the fix message ('Prevent textconv') suggests git config/attribute abuse rather than shell metacharacters, and the patched lines may not be in getDefaultBranch -- verify at freeze. Confidence: medium.

qloapps-customermessage-bo-query-sqli (injection; SQL injection)

  • Repo https://github.com/Qloapps/QloApps (OSL-3.0, 129 MB, languages PHP 80%, Smarty 9%, JavaScript 7%). Lane B. Advisory CVE-2026-75497 / GHSA-5w6r-2mxc-fq3v, published 2026-08-25; affected not stated ('Fixed in 123c97c'); fixed commit 123c97c.
  • Sink: database query in CustomerMessage.php built from the bo_query parameter. Source: bo_query request parameter. Privilege: administrator.
  • Fix: Advisory names 123c97c1 'Fixed: validate request parameters before database query' (PR #1783): classes/CustomerMessage.php +1-1, classes/Address.php +8-8 (twin advisory GHSA-mj48-jjc7-6wqr) and three hotel-module classes. Ancestry: parent.
  • Sites: the advisory names 'CustomerMessage.php' (basename) and the parameter; the classes/ path is from the fix commit; no function named.
  • Benign: fixed pin as fixed-side control; proposed benign change 54c12b4efe41 "fixed issues" (106 lines, classes/order/Order.php, classes/order/OrderPayment.php, modules/hotelreservationsystem/classes/HotelBookingDetail.php…).
  • Caveats: one fix covers two advisories (Address.php is GHSA-mj48); repo 129 MB, near the size cap; function-level site to be resolved at freeze. Confidence: medium.

roundcube-markasjunk-cmd-learn-rce (injection; OS command injection)

  • Repo https://github.com/roundcube/roundcubemail (GPL-3.0, 67 MB, languages PHP 90%, JavaScript 7%). Lane B. Advisory CVE-2026-74997 / GHSA-q5rh-mmp4-ppgq, published 2026-08-17; affected < 1.6.18; 1.7.x < 1.7.3; fixed 1.6.18 / 1.7.3.
  • Sink: the markasjunk plugin's cmd_learn driver runs a shell command with placeholder replacement values. Source: crafted placeholder replacement values (message/user data) when a message is marked as junk. Privilege: authenticated webmail user.
  • Fix: Advisory links 14044f84 (master) and b8f90e28 (1.6 line), both 'Fix RCE via cmd_learn driver of markasjunk plugin' (plugins/markasjunk/drivers/cmd_learn.php +14-10), and a follow-up warning fix 495d2116. The 1.6-line pin is used because it is an ancestor of tag 1.6.18. Ancestry: parent; ancestor of tag 1.6.18.
  • Sites: the advisory names 'the cmd_learn driver of the markasjunk plugin'; the file path follows from that name and is confirmed by the fix commit; no function named.
  • Benign: fixed pin as fixed-side control; proposed benign change 747f544708ed "Simplify" (6 lines, tests/Framework/TnefDecoderTest.php); tests-only change, on master (the fixed pin is on the 1.6 line).
  • Caveats: only instances that enable the markasjunk plugin with the cmd_learn driver. Confidence: medium.

maccms10-template-blacklist-rce (injection; code injection (template → PHP, blacklist bypass))

  • Repo https://github.com/magicblack/maccms10 (GitHub: NOASSERTION [verify], 29 MB, languages PHP 66%, HTML 23%, JavaScript 9%). Lane B. Advisory CVE-2026-71232 / GHSA-cv48-22qx-mpmx, published 2026-08-05; affected before commit 71ad3bb (2026-06-22); fixed commit 71ad3bb.
  • Sink: ThinkPHP {if condition=...} compiled into raw PHP; the admin template editor only blocks a function blacklist. Source: template content saved through the admin template editor. Privilege: administrator.
  • Fix: Advisory names 71ad3bb2 (application/admin/controller/Template.php +1-1: adds the missing functions to the blacklist regex). Ancestry: parent.
  • Sites: file path quoted by the advisory; no function named.
  • Benign: fixed pin as fixed-side control; proposed benign change 668ba418e50e "fix #1356 修正注册API校验器解析错误及缺参报错" (166 lines, application/api/controller/User.php, application/common/model/User.php, tests/regression/user_register_validate.php…); review: subject says it fixes a register-API validator.
  • Caveats: guard bypass (incomplete blacklist); the fix is still a blacklist; licence not declared on GitHub. Confidence: medium.

kirby-realpath-sibling-traversal (path; path traversal (prefix containment check))

  • Repo https://github.com/getkirby/kirby (GitHub: NOASSERTION [verify], 66 MB, languages PHP 77%, Vue 15%). Lane A. Advisory CVE-2026-75592 / GHSA-6j4c-mgqr-qv76, published 2026-09-02; affected < 4.9.5; 5.0.0 - 5.5.1; fixed 4.9.5 / 5.5.2.
  • Sink: Dir::realpath() / F::realpath() containment check accepts a sibling directory sharing the prefix (site vs site2). Source: media handler request path for not-yet-generated thumbnails. Privilege: unauthenticated.
  • Fix: Advisory links 2b6fab95 'fix: Ensure containment in ::realpath()' (4.x line: src/Filesystem/Dir.php, src/Filesystem/F.php) and e0dca5f7 (5.x line, which also carries the Media::thumb fix of GHSA-9vx2-j98c-p72w). The 4.x pin keeps the case to this advisory alone. Ancestry: parent; ancestor of tag 4.9.5 (not of 5.5.2).
  • Sites: Dir::realpath() and F::realpath() named by the advisory; paths confirmed by the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change 3989964ac1cb "fix: Stuck unsaved changes for untouched fields (#8355)" (80 lines, config/fields/object.php, config/fields/toggle.php, src/Form/Field.php…); on the default branch (5.x); the fixed pin is on the 4.x line.
  • Caveats: only deployments whose index root has a sibling directory with the same name prefix; Kirby is under a proprietary licence (GitHub NOASSERTION); must be cleared before publishing. Confidence: medium.

mineadmin-appstore-identifier-traversal (path; path traversal)

  • Repo https://github.com/mineadmin/MineAdmin (Apache-2.0, 53 MB, languages PHP 99%). Lane A. Advisory CVE-2026-55224 / GHSA-59xm-4m8c-g3xj, published 2026-08-18; affected < 3.2.0-alpha.2; fixed 3.2.0-alpha.2.
  • Sink: BASE_PATH . '/plugin/' . $params['identifier'] in download()/install()/unInstall(), then Plugin::install($params['identifier']). Source: identifier request parameter of the app-store plugin endpoints. Privilege: authenticated admin with app-store access (verify).
  • Fix: Advisory links ca41902a 'fix(app-store): 修复app-store几处安全风险。 (#728)' (Service.php +81-9, IndexController.php +4-0). Ancestry: parent; the fixed commit is tag v3.2.0-alpha.2.
  • Sites: file path and methods quoted by the advisory.
  • Benign: fixed pin as fixed-side control; proposed benign change c2f97b772c10 "feat(install): 添加前端项目下载与依赖安装功能 (#735)" (193 lines, app/Command/InstallCommand.php).
  • Caveats: Hyperf framework (not Laravel/Symfony). Confidence: high.

facturascripts-uploadedfile-move-traversal (path; path traversal (arbitrary file write))

  • Repo https://github.com/NeoRazorX/facturascripts (LGPL-3.0, 60 MB, languages PHP 90%, Twig 9%). Lane A. Advisory GHSA-hgjx-r89m-m7v4, published 2026-07-14; affected >= 2025, <= 2026.2; fixed not stated.
  • Sink: UploadedFile::move($destiny, $destinyName) concatenates the client filename into move_uploaded_file(). Source: getClientOriginalName() of an uploaded file. Privilege: authenticated user.
  • Fix: The advisory links no commit and states no patched version. File history of Core/UploadedFile.php has d3770be6 'Fix uploaded file path traversal' (2026-05-19; UploadedFile.php +38-4 plus tests). Inferred, not confirmed by the advisory. Ancestry: parent.
  • Sites: file and method quoted by the advisory.
  • Benign: fixed pin as fixed-side control; proposed benign change add96d2bbee5 "test: add API smoke test" (192 lines, Test/Core/Controller/ApiSmokeTest.php); tests-only change.
  • Caveats: fix commit inferred from file history; the advisory's affected range ends at 2026.2 while the inferred fix is dated 2026-05-19 -- confirm at freeze that the fixed pin is really unaffected. Confidence: medium.

wp-geo-my-wp-info-window-lfi (path; local file inclusion)

  • Repo https://github.com/Fitoussi/geo-my-wp (GitHub: none [verify], 9 MB, languages PHP 47%, JavaScript 44%, CSS 9%). Lane B. Advisory CVE-2026-85200 / GHSA-6hw9-7gx5-mw88, published 2026-09-12; affected <= 4.5.5.3; fixed 4.5.5.4.
  • Sink: include of a file chosen through gmw_posts_locator_ajax_info_window_loader. Source: AJAX request parameters (unauthenticated). Privilege: unauthenticated.
  • Fix: Advisory links 5a768bf1 'Release 4.5.5.4' (5 files: includes/gmw-functions.php +93-6, the posts/members locator functions files, version bumps). A release commit, but small and on-topic. Ancestry: parent.
  • Sites: function named by the advisory text; files from the advisory's own trac reference links (gmw-functions.php#L1945/L1987, gmw-posts-locator-functions.php#L964/L975); the function-to-file pairing is an assumption to confirm at freeze.
  • Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file).
  • Caveats: WordPress plugin; GitHub shows no licence (plugin header GPL presumed, verify); release commit (small). Confidence: medium.

elfinder-fsock-dns-rebinding-ssrf (untrusted_destination; SSRF (DNS rebinding guard bypass))

  • Repo https://github.com/Studio-42/elFinder (GitHub: NOASSERTION [verify], 43 MB, languages JavaScript 65%, PHP 29%). Lane A. Advisory CVE-2026-81889 / GHSA-8x3q-jpjh-qh5c, published 2026-08-31; affected <= 2.1.69; fixed 2.1.70.
  • Sink: fsock_get_contents() fallback reconnects by hostname after the URL validation resolved it (TOCTOU). Source: URL submitted for server-side upload. Privilege: depends on the integrating connector.
  • Fix: Advisory links 6d997386 'Merge commit from fork' (php/elFinder.class.php +113-12, i18n) and the build commit 191372c1. 6d997386 has a single parent dd73e702 (the fix of the sibling ZIP-extraction advisory). Ancestry: parent; ancestor of tag 2.1.70-src (tag 2.1.70 is a build branch with no common history).
  • Sites: function named by the advisory, file linked by the advisory.
  • Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file).
  • Caveats: only when PHP lacks cURL; guard bypass (DNS rebinding); repository is 65% JavaScript; licence NOASSERTION on GitHub (verify). Confidence: medium.

easyappointments-caldav-ssrf (untrusted_destination; SSRF)

  • Repo https://github.com/alextselegidis/easyappointments (GPL-3.0, 49 MB, languages PHP 89%, JavaScript 9%). Lane A. Advisory CVE-2026-52840 / GHSA-pm5p-7w5h-jm5q, published 2026-07-29; affected <= 1.5.2; fixed 1.6.0.
  • Sink: $this->caldav_sync->test_connection($caldav_url, ...) → Guzzle REPORT request. Source: caldav_url request parameter of Caldav::connect_to_server. Privilege: authenticated backend user (admin, provider or secretary).
  • Fix: Advisory links four linear commits of 2026-05-26: 4abb1054 'fix: harden caldav url validation against ssrf' (the validation), then 6b34b78c, 2da2baed, 6eb9336a (opt-in private-host toggle and its relocation). The first carries the fix and is used as the fixed pin; 6eb9336a is the end of the chain if the maintainer prefers it. Ancestry: parent of 4abb1054; ancestor of tag 1.6.0.
  • Sites: controller path and method quoted by the advisory; the library path follows from $this->caldav_sync and the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change 1b51132026c7 "Minor translation change." (2 lines, application/language/german/translations_lang.php).
  • Caveats: fix spread over four linear commits (v2 allowed up to three; the first commit alone is the fix). Confidence: high.

koel-podcast-enclosure-ipv6-ssrf (untrusted_destination; SSRF (guard bypass via IPv6 transition addresses))

  • Repo https://github.com/koel/koel (MIT, 29 MB, languages PHP 55%, TypeScript 27%, Vue 18%). Lane A. Advisory CVE-2026-54494 / GHSA-rjg7-r26h-cfp2, published 2026-07-15; affected <= 9.7.0; fixed 9.7.1.
  • Sink: EpisodePlayable::createForEpisode() → Http::sink($file)->get($url), guarded only by Network::isPublicHost(). Source: <enclosure url> of an attacker-hosted RSS feed subscribed by any user. Privilege: authenticated user.
  • Fix: Advisory links 5f6ce2ce 'fix: close remaining SSRF advisories (DNS rebinding, IPv6 transition, bail) (#2549)', 28 files; one commit that closes several SSRF advisories (same family). Ancestry: parent; ancestor of tag v9.7.1.
  • Sites: app/Helpers/Network.php and isPublicHost quoted by the advisory; EpisodePlayable path from the class name App\Values\Podcast\EpisodePlayable.
  • Benign: fixed pin as fixed-side control; proposed benign change eafb61deaad0 "test: serve a real response to the radio stream connector (#2671)" (178 lines, tests/Integration/Services/Radio/RadioStreamConnectorTest.php, tests/Unit/Services/Radio/RadioStreamConnectorTest.php); tests-only change.
  • Caveats: large multi-advisory fix commit (28 files), same family; exploitation needs NAT64/6to4 routing. Confidence: medium.

pagible-admin-proxy-dns-rebinding-ssrf (untrusted_destination; SSRF (DNS rebinding guard bypass))

  • Repo https://github.com/aimeos/pagible (MIT, 73 MB, languages PHP 57%, JavaScript 16%, CSS 12%, Vue 11%). Lane A. Advisory CVE-2026-49262 / GHSA-mmj8-wcvw-6789, published 2026-06-26; affected < 0.10.4; fixed 0.10.4.
  • Sink: AdminController::proxy → Guzzle request after \Aimeos\Cms\Utils::isValidUrl($url). Source: url query parameter of /cmsproxy. Privilege: authenticated (proxy token).
  • Fix: The advisory links no commit. The compare 0.10.3...0.10.4 has three commits; 09a8205d 'Fixed SSRF via DNS rebinding in admin proxy' (admin/src/Controllers/AdminController.php +21-7, core/src/Utils.php +22-4). Ancestry: parent; ancestor of tag 0.10.4.
  • Sites: class::method names quoted by the advisory; paths from the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change bc5a10a515bd "Fixed admin test" (2 lines, admin/tests/AdminControllerTest.php); tests-only change.
  • Caveats: guard bypass (DNS rebinding). Confidence: medium.

wp-graphql-updatepost-publish-bypass (access_control; missing object-level capability check)

  • Repo https://github.com/wp-graphql/wp-graphql (GPL-3.0, 120 MB, languages PHP 68%, JavaScript 26%). Lane A. Advisory CVE-2026-88974 / GHSA-5mmc-8pc9-wggg, published 2026-09-23; affected < 2.22.2 (confirmed 2.19.0); fixed 2.22.2.
  • Sink: updatePost mutation checks only $post_type_object->cap->edit_posts. Source: GraphQL updatePost mutation input (status PUBLISH, published post id). Privilege: Contributor.
  • Fix: Advisory links 55441663 (PR #4270) whose subject is 'do not invoke bare callable-string field definitions in Model'; it also changes plugins/wp-graphql/src/Mutation/PostObjectUpdate.php (+27-0) -- two fixes in one commit. Ancestry: parent; ancestor of tag wp-graphql/v2.22.2.
  • Sites: the advisory names src/Mutation/PostObjectUpdate.php; the repository is a monorepo (plugins/wp-graphql/ prefix from the fix commit); no function named.
  • Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file).
  • Caveats: fix commit also carries an unrelated Model.php change; function-level site to resolve at freeze. Confidence: medium.

sylius-mollie-thankyou-order-idor (access_control; IDOR (missing ownership check))

  • Repo https://github.com/Sylius/MolliePlugin (MIT, 9 MB, languages PHP 90%). Lane A. Advisory CVE-2026-68501 / GHSA-x83g-979r-f5fh, published 2026-07-31; affected < 2.2.8; 3.0.0-3.2.3; 3.3.0; fixed 2.2.8 / 3.2.4 / 3.3.1.
  • Sink: findOneBy(['id' => $orderId]) without ownership/session check, returning the order token (302 Location) and QR code. Source: orderId of GET /{_locale}/thank-you and /{_locale}/get-code. Privilege: unauthenticated.
  • Fix: Advisory links three merge commits (one per branch). 01316b3a (PR #354, 3.3 line) is used: PageRedirectController.php +17-6, QrCodeAction.php +9-11, PaymentWebhookController.php (the sibling webhook advisory GHSA-rc52-c4hv-w89p). Ancestry: first parent of a merge; ancestor of tag v3.3.1.
  • Sites: Class::method names quoted by the advisory; paths from the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change ad215c9c0fc3 "Refactor PaymentMethodLogoUploader to use FilesystemAdapterInterface instead of Gaufrette\Filesystem." (15 lines, config/services/uploader.xml, src/Uploader/PaymentMethodLogoUploader.php).
  • Caveats: merge commit; one fix covers two advisories (webhook forgery GHSA-rc52 is the other). Confidence: high.

paymenter-checkout-config-override (access_control; unvalidated URL-writable properties override provisioning parameters)

  • Repo https://github.com/Paymenter/Paymenter (MIT, 15 MB, languages PHP 87%, Blade 12%). Lane A. Advisory CVE-2026-47198 / GHSA-5q4q-834j-g8g4, published 2026-06-30; affected < 1.5.1; fixed 1.5.1.
  • Sink: $checkoutConfig (#[Url], alias config) keys stored by Cart.php into service properties, later passed to createServer(). Source: config[...] query parameters of the checkout page. Privilege: authenticated customer.
  • Fix: The advisory links no commit. The compare v1.5.0...v1.5.1 has 17 commits; 75719ae4 'Merge commit from fork' changes only app/Livewire/Products/Checkout.php (+7-1). Ancestry: parent; ancestor of tag v1.5.1.
  • Sites: file paths quoted by the advisory; no function named.
  • Benign: fixed pin as fixed-side control; proposed benign change e60567981acf "fix: reCAPTCHA v3 not working after Livewire navigation" (24 lines, themes/default/views/components/captcha/recaptcha-v3.blade.php); review: subject mentions reCAPTCHA (anti-abuse).
  • Caveats: mass-assignment shape (CWE-20/639); classed access_control by its CWE; fix commit inferred from the release compare. Confidence: medium.

wp-buddypress-messages-rest-idor (access_control; IDOR in REST permission callback)

  • Repo https://github.com/buddypress/buddypress (GitHub: none [verify], 79 MB, languages PHP 76%, CSS 14%, SCSS 6%). Lane A. Advisory CVE-2026-53673 / GHSA-j3j5-5m8v-7gvc, published 2026-06-10; affected < 14.5.0 (confirmed 14.4.0); fixed 14.5.0.
  • Sink: get_item_permissions_check validates the supplied user_id instead of the logged-in user; reused by update/delete. Source: user_id parameter of the messages REST API. Privilege: authenticated (any user).
  • Fix: Advisory links 27d41e97 'Improve security of messages endpoint.' (class-bp-messages-rest-controller.php +113-42, tests). The commit is dated 2026-07-07, after the advisory; confirm at freeze that the release carrying it is 14.5.0. Ancestry: parent.
  • Sites: method named by the advisory; file path from the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change ea5cb85f4d8a "PHPDoc: Improve parameter descriptions." (132 lines, src/bp-activity/bp-activity-embeds.php, src/bp-activity/bp-activity-filters.php, src/bp-activity/bp-activity-functions.php…).
  • Caveats: the GitHub repository is the project's own mirror of its development SVN; no GitHub licence metadata (GPL-2.0+ per project, verify). Confidence: medium.

sharp-editor-iframe-srcdoc-xss (output_encoding; stored XSS (sanitizer allow-list))

  • Repo https://github.com/code16/sharp (MIT, 109 MB, languages PHP 66%, Vue 23%, TypeScript 9%). Lane A. Advisory CVE-2026-61823 / GHSA-qxg3-46rw-79j8, published 2026-09-25; affected < 9.22.5; fixed 9.22.5.
  • Sink: Symfony HtmlSanitizer config allows the iframe srcdoc attribute; the value is rendered as live HTML. Source: Editor field content saved by a user with edit permission. Privilege: authenticated editor.
  • Fix: Advisory links ec509a22 'Improve sanitization' (src/Utils/Sanitization/FormatsSanitizedValue.php +4-2, test). The same commit fixes the sibling GHSA-vj3q-vp3g-j9c8. Ancestry: parent; ancestor of tag v9.22.5.
  • Sites: file path quoted by the advisory; no function named. sink_evidence srcdoc.
  • Benign: fixed pin as fixed-side control; proposed benign change 7c601fffe930 "Update version to v9.22.5" (2 lines, src/SharpInternalServiceProvider.php).
  • Caveats: the flaw is a sanitizer allow-list entry, not a missing escape call. Confidence: medium.

privatebin-jsonld-request-uri-injection (output_encoding; reflected JSON injection (CWE-116))

  • Repo https://github.com/PrivateBin/PrivateBin (GitHub: NOASSERTION [verify], 16 MB, languages PHP 46%, JavaScript 38%, CSS 16%). Lane A. Advisory CVE-2026-55891 / GHSA-xrjc-c68j-hp7w, published 2026-08-28; affected <= 2.0.4; fixed 2.0.5.
  • Sink: Controller::_jsonld() splices $_urlBase into a .jsonld template with str_replace(). Source: $_SERVER['REQUEST_URI'] via Request::getRequestUri() (FILTER_SANITIZE_URL keeps quotes and angle brackets). Privilege: unauthenticated.
  • Fix: Advisory links 75f056dc 'Merge commit from fork' (first-parent diff: lib/Request.php +2-2, lib/Configuration.php, CHANGELOG, test). Its first parent e0dd4c02 is the fix of the sibling attachment-XSS advisory GHSA-f2xf-7x3g-4272. Ancestry: first parent of a merge; ancestor of tag 2.0.5.
  • Sites: Class::method names quoted by the advisory; paths lib/*.php from the fix commit.
  • Benign: fixed pin as fixed-side control; proposed benign change 48ae4ed5d3d4 "fix: quote administration storage path" (54 lines, bin/administration, tst/AdministrationEmptyDirsTest.php); review: 'quote administration storage path' may be a shell-quoting fix.
  • Caveats: the fix changes Request.php only; Controller::_jsonld is a declared site outside the diff; response type is JSON-LD, not HTML; licence NOASSERTION on GitHub (zlib-style per project, verify). Confidence: high.

openstamanager-group-name-html-injection (output_encoding; stored HTML injection)

  • Repo https://github.com/devcode-it/openstamanager (GPL-3.0, 43 MB, languages PHP 80%, JavaScript 17%). Lane A. Advisory CVE-2026-44701 / GHSA-crx4-7mmq-j74j, published 2026-08-26; affected <= 2.10.1; fixed 2.11-beta.
  • Sink: '<span class="text-primary">'.$group->getTranslation('title').'</span>' in modules/utenti/edit.php. Source: group name saved when creating a user group. Privilege: authenticated user able to create groups.
  • Fix: Advisory links 0b88ad19 'fix: HTML Injection in modules/utenti/edit.php' (edit.php +2-2, ajax/select.php, src/AJAX.php, src/Modules.php) and a broader input-filter refactor 7c9eafe9. The first is used. Ancestry: parent; ancestor of tag v2.11-beta.
  • Sites: file and code quoted by the advisory. sink_evidence $group->getTranslation('title').
  • Benign: fixed pin as fixed-side control; proposed benign change 570eff68c504 "fix: definizione variabile" (2 lines, modules/fatture/src/Gestori/Scadenze.php).
  • Caveats: second advisory commit (7c9eafe9, global GET/POST filtering) is not in the pinned pair. Confidence: high.

symfony-ux-live-child-tag-xss (output_encoding; XSS (unescaped tag name))

  • Repo https://github.com/symfony/ux (MIT, 59 MB, languages PHP 61%, TypeScript 22%, JavaScript 10%, Twig 7%). Lane A. Advisory CVE-2026-49210 / GHSA-38x5-rcv4-xf7x, published 2026-06-19; affected ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0; fixed 2.36.0 / 3.1.0.
  • Sink: ChildComponentPartialRenderer::createHtml() interpolates $childTag into HTML. Source: client JSON children[id].tag parsed by LiveComponentSubscriber and passed through InterceptChildComponentRenderSubscriber. Privilege: unauthenticated (Accept header gate; CORS or same-origin needed).
  • Fix: Advisory links fbc5e9a1 '[LiveComponent] Reject malicious child component tags' (ChildComponentPartialRenderer.php +7-0, test). Ancestry: parent; ancestor of tag v2.36.0.
  • Sites: FQCN::method quoted by the advisory; monorepo path from the fix commit.
  • Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file).
  • Caveats: the advisory calls it primarily defense in depth (custom Accept header cannot be sent cross-origin without preflight); component framework in a monorepo (UX packages). Confidence: medium.

wp-podlove-generation-guard-poi (deserialization; PHP object injection → arbitrary file deletion (in-plugin POP chain))

  • Repo https://github.com/podlove/podlove-publisher (MIT, 33 MB, languages PHP 63%, JavaScript 18%, Vue 10%, TypeScript 6%). Lane C. Advisory CVE-2026-16099 / GHSA-q83h-6954-x259, published 2026-08-16; affected <= 4.5.3; fixed 4.5.4 (not stated in the advisory; first release after the fix).
  • Sink: unserialize() of model data (lib/model/base.php#L552) instantiating Podlove\ImageCache\GenerationGuard, whose __destruct() calls wp_delete_file(). Source: shownotes REST input handled by create_link_item (contributor+). Privilege: Contributor.
  • Fix: The advisory links wp.org trac only. The GitHub history of the referenced files has three consecutive commits of 2026-07-26: d49c4d7f 'fix: constrain image lock deletion' (generation_guard.php), b59d7962 'fix: harden shownotes REST input' (rest_api.php +173-20), ea878175 'fix: limit model unserialization' (lib/model/base.php). The pair spans all three (vulnerable = parent of d49c4d7f). Ancestry: linear chain of 3 commits (4eedbd66 → d49c4d7f → b59d7962 → ea878175); ancestor of tag 4.5.4.
  • Sites: create_link_item and GenerationGuard::__destruct named by the advisory; files from the advisory's own trac reference links.
  • Benign: fixed pin as fixed-side control; proposed benign change 50da8db0f5a8 "fix PHP warning" (2 lines, lib/modules/contributors/contributor_list_table.php).
  • Caveats: fix inferred from file history (three commits); the advisory text describes the impact (file deletion) under CWE-502. Confidence: medium.

wp-admin-columns-ids-to-collection-poi (deserialization; PHP object injection (bundled POP chain))

  • Repo https://github.com/codepress/admin-columns (GPL-3.0, 37 MB, languages PHP 69%, Svelte 10%, SCSS 7%, JavaScript 6%, TypeScript 6%). Lane C. Advisory CVE-2026-7654 / GHSA-h6x4-229g-5f43, published 2026-06-06; affected <= 7.0.18; fixed 7.0.19 (not stated; first release after the fix).
  • Sink: unserialize() without allowed_classes in IdsToCollection::get_ids_from_string(). Source: post meta values set by a Contributor. Privilege: Contributor.
  • Fix: The advisory links wp.org trac only. The compare 7.0.18...7.0.19 has one commit touching the named file: c64e9aae 'Update IdsToCollection.php' (+1-1). An identical change 25e276e0 sits on the 7.1 development line. Inferred; the commit message does not say what changed. Ancestry: parent; ancestor of tag 7.0.19.
  • Sites: Class::method named by the advisory; files from its trac reference links. sink_evidence unserialize(.
  • Benign: fixed pin as fixed-side control; proposed benign change e998321863c4 "Todo ans PHP code fixer" (40 lines, classes/ColumnCollection.php, classes/DI/Container.php, classes/Exception/IteratorException.php…).
  • Caveats: fix inferred (one-line change, uninformative message) -- confirm at freeze that it adds allowed_classes. Confidence: medium.

Recommended balanced selection (16)

Rule (applied mechanically to the 26, never by how easy a case looks): per-family targets injection 5, output_encoding 3, path 3, untrusted_destination 2, access_control 2, deserialization 1. Within a family, candidates whose fix commit the advisory names come first, then newest first by publication; take the first n. The WordPress cap is checked afterwards, not used to choose.

  • injection (5): gitlist-commandline-cmdi (2026-08-31), qloapps-customermessage-bo-query-sqli (2026-08-25), roundcube-markasjunk-cmd-learn-rce (2026-08-17), winter-filter-numberrange-sqli (2026-08-12), maccms10-template-blacklist-rce (2026-08-05), mantisbt-tokenizer-eval-rce (2026-07-15), grav-blueprint-bare-function-rce (2026-09-17, fix inferred), backpack-stats-host-header-cmdi (2026-08-20, fix inferred)
  • output_encoding (3): sharp-editor-iframe-srcdoc-xss (2026-09-25), privatebin-jsonld-request-uri-injection (2026-08-28), openstamanager-group-name-html-injection (2026-08-26), symfony-ux-live-child-tag-xss (2026-06-19)
  • path (3): wp-geo-my-wp-info-window-lfi (2026-09-12), kirby-realpath-sibling-traversal (2026-09-02), mineadmin-appstore-identifier-traversal (2026-08-18), facturascripts-uploadedfile-move-traversal (2026-07-14, fix inferred)
  • untrusted_destination (2): elfinder-fsock-dns-rebinding-ssrf (2026-08-31), easyappointments-caldav-ssrf (2026-07-29), koel-podcast-enclosure-ipv6-ssrf (2026-07-15), pagible-admin-proxy-dns-rebinding-ssrf (2026-06-26, fix inferred)
  • access_control (2): wp-graphql-updatepost-publish-bypass (2026-09-23), sylius-mollie-thankyou-order-idor (2026-07-31), wp-buddypress-messages-rest-idor (2026-06-10), paymenter-checkout-config-override (2026-06-30, fix inferred)
  • deserialization (1): wp-podlove-generation-guard-poi (2026-08-16, fix inferred), wp-admin-columns-ids-to-collection-poi (2026-06-06, fix inferred)

Selected (bold above): winter-filter-numberrange-sqli, gitlist-commandline-cmdi, qloapps-customermessage-bo-query-sqli, roundcube-markasjunk-cmd-learn-rce, maccms10-template-blacklist-rce, kirby-realpath-sibling-traversal, mineadmin-appstore-identifier-traversal, wp-geo-my-wp-info-window-lfi, elfinder-fsock-dns-rebinding-ssrf, easyappointments-caldav-ssrf, wp-graphql-updatepost-publish-bypass, sylius-mollie-thankyou-order-idor, sharp-editor-iframe-srcdoc-xss, privatebin-jsonld-request-uri-injection, openstamanager-group-name-html-injection, wp-podlove-generation-guard-poi. Mix: injection 5 (31%; SQL 2, OS command 2, code 1), output_encoding 3, path 3, untrusted_destination 2, access_control 2, deserialization 1; WordPress 3 of 16. Benign controls: the fixed pin for every case; a proposed benign change exists for 12 of 16 (gitlist, geo-my-wp, elfinder and wp-graphql need one chosen at freeze).

The deserialization pick has an inferred fix (both deserialization candidates do); it is the only family where the named-fix rule could not be met.

Open decisions for the maintainer

  • Protocol coverage. Protocol v2 scores only injection, untrusted_destination and config_secrets. v3 as proposed also needs scoring rules for path, output_encoding, access_control and deserialization (including what counts as a match for an absence bug such as a missing check, and the output_encoding limits stated in families.toml). Decide the family set before the population is reserved; dropping families changes the selection rule's targets, not the candidates.
  • File-only sites. Seven candidates have no advisory-named function (mantisbt, qloapps, roundcube, maccms10, wp-graphql, paymenter, sharp); several others name a second file without a function (site_files). Protocol v2 credits path::function; for these the function has to be resolved at freeze by reading the file, or the protocol must credit a file-level site. Where the advisory quotes code, sink_evidence carries it for freeze.py.
  • Sites derived from class names. Several advisories name Class::method but not the file; the path follows from PSR-4 or the plugin layout and is confirmed only by the fix commit's file list (marked in site_derivation).
  • Licences to clear before publishing: Kirby (proprietary Kirby licence, not OSI), MacCMS10 (no licence metadata), elFinder and PrivateBin (NOASSERTION; project files state BSD-3 and zlib-style respectively, verify), MantisBT, BuddyPress and GEO my WP (no GitHub licence metadata; GPL per project, verify).
  • Inferred fixes: grav, backpack, pagible and paymenter come from release compares with a single on-topic commit; facturascripts, podlove and admin-columns from file history (admin-columns' commit message is only 'Update IdsToCollection.php'). Freeze must confirm each diff changes the sink as the advisory describes.
  • Multi-advisory fixes: koel (28 files, several SSRF advisories), sylius mollie (merge also fixes the webhook advisory), sharp, privatebin, qloapps and wp-graphql (commit also changes Model.php).
  • Non-default configuration required: winter (plugin-registered scope), roundcube (markasjunk cmd_learn), elfinder (no cURL), kirby (sibling directory), backpack (exec/curl and Host passthrough), symfony-ux (CORS or same-origin).
  • Branch pins: kirby uses the 4.x-line fix (the 5.x fix also carries another advisory); roundcube uses the 1.6-line fix; sylius mollie uses the 3.3-line merge. Benign proposals come from the default branch, which may not contain these pins.
  • Prior mention. research-2026-09-26.md lists some of these advisory ids by name in its 'passed over without examination' note (Grav, elFinder, Backpack CRUD, Winter, Easy!Appointments, Koel). They were never examined and their URLs are not in the tree, so they pass the exclusion rule; the maintainer may still prefer to drop them.
  • Alternates if a candidate fails at freeze (first in line for its family, newest first): injection — Krayin CRM leads DataGrid SQLi (GHSA-8879-fh4f-q3qm), FrontAccounting SQLi ×3 (GHSA-w5j4-x499-pfwp …), LMS SQLi/command injection (GHSA-qrw9-xj5g-qxw8, GHSA-765c-7qf8-cw9w), Dockwatch command injection (GHSA-cgfv-42v7-7f53), MantisBT history_order SQLi (GHSA-mw6p-33vw-46cc, same repository as the MantisBT candidate); path — GEOFlow ImageLibraryController (GHSA-gf7h-mv4h-gg7c), rConfig download_export (GHSA-qrrp-6pvj-xfvf); untrusted_destination — CakePHP Authentication open redirect (GHSA-hhpq-7wg4-36jm), Koillection SSRF (GHSA-gmxh-hjfv-qc2w), Cotonti open redirects (GHSA-g8jm-3grw-8wh2 …); deserialization — Cypht logout back_query (GHSA-46j6-w3hw-4r9x; fix e4aa2f34 known, but the advisory names no file or function). None of the alternates was fully verified.

What constrained the search

  • Deserialization is nearly absent with a usable fix. Lane A had one eligible record (October CMS, whose public repository only receives bulk 'Sync upstream' commits). Lanes B and C yielded two, both WordPress, both with fixes inferred from file history; most WordPress object-injection records name no function or have no development repository.
  • SQL injection with a fix diff is scarce outside excluded or oversized repositories. Most 2026 PHP SQLi advisories are on repositories already used (phpMyFAQ, YesWiki, froxlor, pimcore studio), over the size cap (Pimcore, TYPO3, Mautic, LimeSurvey, CodeIgniter4, Dolibarr, LibreNMS), in framework query builders (CakePHP), or in WordPress plugins with no GitHub repository. Only two SQLi candidates qualified in quota order; more exist as alternates.
  • The size cap is the largest single filter (161 rejections): Craft CMS, Snipe-IT (32 advisories), TYPO3, Pimcore, Shopware, Sylius core, Mautic, Filament, AVideo, LibreNMS, MISP, Dolibarr, OpenEMR, ILIAS, Joomla.
  • Naming the site. 46 advisories name no file or function (Statamic, Silverstripe and most WordPress records).
  • Kimai shipped the fixes for nine of this window's advisories inside one 'Release 2.58' squash, which removes a whole application from the pool.

Rejection log

One line per examined advisory, newest first within each lane. taken rows name the candidate. Automatic exclusions by metadata are listed first within lane A.

Lane A: reviewed composer advisories

  • GHSA-r6hr-vr92-vv28 / CVE-2026-65954 (phpcsstandards/phpcsutils, injection, 2026-09-29): developer tool / CLI, not a web application. PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualAr
  • GHSA-jh5r-qr3c-85q8 / CVE-2026-102279 (laravel/framework, output_encoding, 2026-09-29): DOM XSS in the debug page's JavaScript tooltip (Tippy allowHTML); the sink is client-side JavaScript, and the advisory names no PHP file or function. Laravel: XSS in Debug Page Information
  • GHSA-v65j-hff3-753c / CVE-2026-57440 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-09-25): excluded by name. Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequ
  • GHSA-qxg3-46rw-79j8 / CVE-2026-61823 (code16/sharp, output_encoding, 2026-09-25): taken as sharp-editor-iframe-srcdoc-xss. code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
  • GHSA-vj3q-vp3g-j9c8 / CVE-2026-61825 (code16/sharp, output_encoding, 2026-09-25): one case per repository (repository taken as sharp-editor-iframe-srcdoc-xss). code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
  • GHSA-87mg-5grr-rhwh / CVE-2026-57232 (contao/contao, untrusted_destination, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Mod
  • GHSA-rw77-vq4g-x3hp / CVE-2026-56738 (thorsten/phpmyfaq, injection, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). phpMyFAQ has SQL Injection in StopWords::add() — Unescaped Stop Word Insertion
  • GHSA-pgwp-vc7q-cvj3 / CVE-2026-56736 (thorsten/phpmyfaq, output_encoding, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submiss
  • GHSA-396x-xmvh-p563 / CVE-2026-63498 (grokability/snipe-it, output_encoding, 2026-09-24): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
  • GHSA-p9h3-gvpq-5539 / CVE-2026-62368 (grokability/snipe-it, output_encoding, 2026-09-24): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
  • GHSA-9rg8-2wvr-fgjh / CVE-2026-76089 (verbb/formie, access_control, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). Formie: Missing authorization on sent notification resend modal exposes submission PII
  • GHSA-584p-f93j-wpgc / CVE-2026-76087 (verbb/formie, access_control, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). Formie: Unauthenticated users can overwrite incomplete submissions via submit action
  • GHSA-v3f3-cmj4-cvj9 / CVE-2026-76086 (verbb/formie, access_control/untrusted_destination, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). Formie: Integration form-settings action allows SSRF and exfiltration of stored integratio
  • GHSA-jg26-q8hg-3pq4 / CVE-2026-92692 (sulu/sulu, injection, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). Sulu: JCR-SQL2 injection via categories query parameter (unauthenticated)
  • GHSA-gxrg-x694-283w / CVE-2026-73858 (solspace/craft-freeform, injection, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). Solspace Freeform: Limited Twig template injection via submitted field values
  • GHSA-w998-qmw9-mf4m / CVE-2026-63002 (redaxo/core, output_encoding, 2026-09-23): repo over ~150 MB (500 MB per GitHub API). REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
  • GHSA-mf2p-wjp4-99pq / CVE-2026-63001 (redaxo/core, output_encoding, 2026-09-23): repo over ~150 MB (500 MB per GitHub API). REDAXO: Stored XSS via Unescaped Media Manager Type Name in mediaIsInUse()
  • GHSA-5mmc-8pc9-wggg / CVE-2026-88974 (wp-graphql/wp-graphql, access_control, 2026-09-23): taken as wp-graphql-updatepost-publish-bypass. _WPGraphQL: Contributor can publish and modify posts without the required capabilities via _
  • GHSA-jr78-w6w5-m8f8 (semanticmediawiki/semanticmediawiki, access_control, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticate
  • GHSA-9rcc-pmj8-ffhr (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (resi
  • GHSA-cx86-7xwp-w9wf / CVE-2026-77616 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki affected by reflected XSS in Special:Ask via a forged cursor paginati
  • GHSA-q5fm-9mx6-44f4 / CVE-2026-77610 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki has a query debug output XSS (DebugFormatter)
  • GHSA-hw3m-8j5x-94ff / CVE-2026-77609 (semanticmediawiki/semanticmediawiki, untrusted_destination, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki has an open redirect in Special:URIResolver
  • GHSA-7xv3-gf2g-498h / CVE-2026-77607 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki affected by Special:Ask table sep parameter reflected XSS
  • GHSA-59xw-qv23-j3rc / CVE-2026-77608 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki has reflected XSS in Special:SearchByProperty (property and value
  • GHSA-3jp5-3h47-28qf / CVE-2026-77606 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
  • GHSA-hg8h-557g-q8pp / CVE-2025-61682 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reser
  • GHSA-g4c3-4g96-6g4m / CVE-2026-45140 (chamilo/chamilo-lms, injection/path, 2026-09-17): repo over ~150 MB (1625 MB per GitHub API). Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
  • GHSA-r94f-hx44-8jqf / CVE-2026-72819 (getgrav/grav, injection, 2026-09-17): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) (only the attacker's shell.php). Grav CMS vulnerable to remote code execution via .zip file upload
  • GHSA-xhfv-7758-r9hx / CVE-2026-75837 (getgrav/grav, access_control, 2026-09-17): the fix changes only a YAML blueprint (system/blueprints/user/group.yaml); no PHP line changes, so the fixed pin cannot be told apart in PHP. Grav: Missing admin.super guard on core group blueprint access field allows admin.users op
  • GHSA-q2j8-x8hf-63ch / CVE-2026-75834 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing th
  • GHSA-f8wv-xp27-6gq7 / CVE-2026-75827 (getgrav/grav, injection, 2026-09-17): taken as grav-blueprint-bare-function-rce. Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, g
  • GHSA-vfmf-q6x9-cw96 / CVE-2026-75828 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted
  • GHSA-4v9q-p283-qc2m / CVE-2026-74907 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset
  • GHSA-jq29-c7v8-rg55 / CVE-2026-72695 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
  • GHSA-vjqc-q4mp-2rvf / CVE-2026-79752 (cakephp/cakephp, injection, 2026-09-17): framework query-builder API (FunctionsBuilder); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
  • GHSA-47ch-6w46-6xm7 / CVE-2026-72697 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: media_directory() Twig function allows filesystem path traversal and file content di
  • GHSA-6qw9-4vv5-jr97 / CVE-2026-75831 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Stored XSS via Markdown audio/video media URL
  • GHSA-269c-h76q-8cxw / CVE-2026-72832 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Stored XSS via quoted-attribute bypass in detectXss
  • GHSA-w3f4-8pj2-599w / CVE-2026-69089 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-
  • GHSA-7pgq-cr25-xvc8 / CVE-2026-69088 (getgrav/grav, injection, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static m
  • GHSA-ffmg-hfvg-jhg9 / CVE-2026-58657 (getgrav/grav, output_encoding, 2026-09-16): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitize
  • GHSA-2c4f-86xc-cr74 / CVE-2026-61453 (getgrav/grav, injection/output_encoding, 2026-09-16): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
  • GHSA-2ff2-mx52-q8wp / CVE-2026-49400 (octobercms/october, deserialization, 2026-09-14): no fix diff in the public repository: modules/backend/traits/SessionMaker.php last changed in a bulk 'Sync upstream (4.2)' commit (2026-05-20), and there is no v4.2.23 tag. October CMS: PHP Object Injection via Backend Widget Session Storage
  • GHSA-xv9m-fm3w-8w5x / CVE-2026-46696 (octobercms/october, access_control, 2026-09-14): no fix diff in the public repository (same bulk 'Sync upstream' history, no v4.2.23 tag); advisory names no vulnerable file or function (a sites entry cannot be declared from its text). October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
  • GHSA-2cg9-97gq-9mqp / CVE-2026-56825 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopper: Missing authorization on product removal actions in CollectionProducts component
  • GHSA-99h5-jhh7-v3r3 / CVE-2026-56830 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9
  • GHSA-g3f9-g5vj-p62f / CVE-2026-56829 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopper: Unauthorized inventory stock manipulation via unlocked variant property in Varian
  • GHSA-j328-xmgp-j4q3 / CVE-2026-56828 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopper: privilege escalation via improper Livewire admin component authorization
  • GHSA-f7h9-qv4x-9x57 / CVE-2026-56826 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopping privilege escalation through missing authorization in Settings components
  • GHSA-243p-f3cv-c5wh / CVE-2026-56827 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-de
  • GHSA-23rh-xw42-fq82 / CVE-2026-55416 (pimcore/pimcore, injection, 2026-09-10): repo over ~150 MB (534 MB per GitHub API). Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
  • GHSA-65fr-j4p9-vc33 / CVE-2026-81525 (mongodb/mongo-php-library, injection, 2026-09-08): general-purpose library: the attacker source lies in the calling application, not in the repo. mongodb: Reject "." and NUL bytes in database and collection names
  • GHSA-rvx4-ffvw-m9q3 / CVE-2026-84361 (composer/composer, injection, 2026-09-08): developer tool / CLI, not a web application. Composer arbitrary command execution via a malicious package's Perforce source URL
  • GHSA-c7r6-vx3h-w5g2 / CVE-2026-84374 (spartnernl/laravel-excel, path, 2026-09-08): general-purpose library: the attacker source lies in the calling application, not in the repo. Laravel Excel writes exports outside the configured filesystem disk when given a caller-co
  • GHSA-fxf7-vhh8-7vpq / CVE-2026-77635 (cakephp/cakephp, injection, 2026-09-08): framework query-builder API (FunctionsBuilder::jsonValue()); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
  • GHSA-pp4x-ccxq-6r33 / CVE-2026-82396 (sulu/sulu, output_encoding, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). Sulu: Stored XSS via media download inline-disposition override
  • GHSA-65cv-w493-7vhq / CVE-2026-82394 (sulu/sulu, access_control, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). Sulu: Fix authorization bypass when creating preview links
  • GHSA-h6cx-gjxx-v25c / CVE-2026-82395 (sulu/sulu, access_control, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). Sulu: Media move/update authorization bypass (IDOR)
  • GHSA-6j4c-mgqr-qv76 / CVE-2026-75592 (getkirby/kirby, path, 2026-09-02): taken as kirby-realpath-sibling-traversal. Kirby: Access to image files outside of the site root via path traversal in the media hand
  • GHSA-fj2p-qj2f-74v5 / CVE-2026-64850 (getgrav/grav, injection, 2026-09-02): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
  • GHSA-g2fm-8hr4-j82h / CVE-2026-81892 (easycorp/easyadminbundle, access_control, 2026-09-02): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) (only the public API Action::linkToRoute(); the dispatcher that swaps controllers is described, not named). EasyAdmin custom-action dispatcher bypasses access_control on other routes
  • GHSA-g3hc-697w-wm82 / CVE-2026-81887 (livewire/livewire, output_encoding, 2026-09-02): DOM-based XSS in Livewire's client-side JavaScript; not a PHP sink. Livewire DOM-based cross-site scripting during client-side state handling
  • GHSA-f8fg-pg57-v4j8 (thephpleague/commonmark, output_encoding, 2026-09-01): general-purpose library: the attacker source lies in the calling application, not in the repo. league/commonmark XSS: on* event-handler filter in AttributesExtension bypassed with a
  • GHSA-cq55-c7wv-pxmq / CVE-2026-62993 (smarty-php/smarty, untrusted_destination, 2026-09-01): general-purpose library: the attacker source lies in the calling application, not in the repo. Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
  • GHSA-67mx-6wf2-92xp / CVE-2026-71415 (getkirby/kirby, access_control, 2026-08-31): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: File upload permissions are not checked during processing of chunk data
  • GHSA-9vx2-j98c-p72w / CVE-2026-75594 (getkirby/kirby, path, 2026-08-31): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: Access to image files and limited access to JSON files outside of the site root via
  • GHSA-8x3q-jpjh-qh5c / CVE-2026-81889 (studio-42/elfinder, untrusted_destination, 2026-08-31): taken as elfinder-fsock-dns-rebinding-ssrf. elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback
  • GHSA-9x44-4gxf-8c25 / CVE-2026-55634 (pimcore/pimcore, injection, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
  • GHSA-w23p-wrp7-ch38 / CVE-2026-55220 (pimcore/pimcore, deserialization, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object
  • GHSA-f97c-ph8j-8vff / CVE-2026-55212 (pimcore/pimcore, access_control, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privil
  • GHSA-79cw-hfcc-7mw9 / CVE-2026-55208 (pimcore/pimcore, injection, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). _Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract _
  • GHSA-575r-357h-fhch / CVE-2026-55516 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
  • GHSA-35cr-9hqq-p2mg / CVE-2026-55515 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpo
  • GHSA-w7qw-5wfv-gwx9 / CVE-2026-55481 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has CSS Injection via header_color Setting
  • GHSA-8frh-vhgh-64cf / CVE-2026-55479 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has incorrect permission for legacy license checkin API _
  • GHSA-crv3-j83j-f3r6 / CVE-2026-55478 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has missing object-level authorization in Kits API
  • GHSA-53jc-27pc-x8r8 / CVE-2026-55476 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_adm
  • GHSA-5wx7-xq8j-v4qm / CVE-2026-55475 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT's import created_by can be overwritten
  • GHSA-c6f4-wj38-m3g3 / CVE-2026-55474 (grokability/snipe-it, path, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT vulnerable to directory traversal in displaySig
  • GHSA-8w8c-8mx9-52cw / CVE-2026-55472 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
  • GHSA-xr9m-gphc-9p63 / CVE-2026-55469 (grokability/snipe-it, path, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has a path traversal vulnerability via CSV import image field
  • GHSA-jhph-5q74-pmfx / CVE-2026-55466 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT vulnerable to stored XSS via inline-served attachment
  • GHSA-r52f-r9v5-66xr / CVE-2026-55464 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT vulnerable to stored XSS via Markdown custom field _
  • GHSA-fc33-6w3q-538h / CVE-2026-55462 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has an authorization bypass on print inventory page
  • GHSA-wg2f-x2c2-c4rp / CVE-2026-55461 (grokability/snipe-it, untrusted_destination, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has an Open Redirect After User Edit
  • GHSA-vgx7-c78r-69w9 / CVE-2026-55460 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has an authorization bypass on bulk editing users
  • GHSA-m4g4-86qc-v8w7 / CVE-2026-55779 (silverstripe/silverstripe-versioned, output_encoding, 2026-08-28): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) (only the ArchiveAdmin screen; the fix is in src/RestoreAction.php). silverstripe/versioned has XSS in archive admin restore
  • GHSA-xrjc-c68j-hp7w / CVE-2026-55891 (privatebin/privatebin, output_encoding, 2026-08-28): taken as privatebin-jsonld-request-uri-injection. PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
  • GHSA-f2xf-7x3g-4272 / CVE-2026-55696 (privatebin/privatebin, output_encoding, 2026-08-28): one case per repository (repository taken as privatebin-jsonld-request-uri-injection). PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link
  • GHSA-39mm-rwm3-29jp / CVE-2026-54718 (silverstripe/silverstripe-advancedworkflow, injection, 2026-08-27): advisory names no vulnerable file or function (a sites entry cannot be declared from its text); the fix only bumps a dependency in composer.json (the repair lives in another package). silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow em
  • GHSA-g8wr-r2v2-vqc6 / CVE-2026-54721 (silverstripe/silverstripe-userforms, injection, 2026-08-27): advisory names no vulnerable file or function (a sites entry cannot be declared from its text); the fix only bumps a dependency in composer.json (the repair lives in another package). silverstripe/userforms vulnerable to remote code execution via userforms email subject
  • GHSA-gvrw-qqp5-jgc5 / CVE-2026-54720 (silverstripe/silverstripe-framework, output_encoding, 2026-08-27): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) ('Insert media from web'). Silverstripe Framework: Possible XSS attack through media embed
  • GHSA-7w8c-qgxg-m7jx (librenms/librenms, output_encoding, 2026-08-26): repo over ~150 MB (369 MB per GitHub API). LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
  • GHSA-crx4-7mmq-j74j / CVE-2026-44701 (devcode-it/openstamanager, output_encoding, 2026-08-26): taken as openstamanager-group-name-html-injection. OpenSTAManager has HTML Injection in modules/utenti/edit.php
  • GHSA-mf8r-wm2w-f8c5 (thorsten/phpmyfaq, access_control, 2026-08-25): repo in used list (already referenced under benchmarks/src/tests/.kiro). phpMyFAQ public FAQ APIs expose inactive FAQ content
  • GHSA-88g4-74f3-63x9 (thorsten/phpmyfaq, path, 2026-08-25): repo in used list (already referenced under benchmarks/src/tests/.kiro). phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
  • GHSA-896w-cw95-xq7w (, path, 2026-08-25): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrar
  • GHSA-rj4c-4q9x-543x (, path, 2026-08-25): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal
  • GHSA-5h77-88j3-r659 / CVE-2026-63135 (yourls/yourls, output_encoding, 2026-08-21): repo over ~150 MB (489 MB per GitHub API). YOURLS has stored XSS in referrer statistics chart via crafted Referer header
  • GHSA-hrwp-4hh9-c8r8 / CVE-2026-59989 (phalcon/cphalcon, injection, 2026-08-21): repo over ~150 MB (273 MB per GitHub API). Phalcon Volt compiler join filter compile-time PHP code injection (SSTI leads to RCE)
  • GHSA-8hgv-xc77-jmcr (getgrav/grav, output_encoding, 2026-08-21): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's _
  • GHSA-hq84-x37p-j6q5 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Reflected XSS through the search query parameter in the backend Table widget
  • GHSA-5cwr-5jxg-pcf6 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
  • GHSA-fm29-4mq3-phg6 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
  • GHSA-mpmw-f6h6-3g26 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: My Account preview exposes another backend user's profile by record ID
  • GHSA-7mpf-4465-7fc2 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Stored XSS through Backend List widget image columns
  • GHSA-2223-f22x-24cq (wintercms/winter, path, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Local File Inclusion through =include directives in JavaScript asset compilation
  • GHSA-58fp-mcx6-7qf9 / CVE-2026-63179 (wintercms/winter, path, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Local File Inclusion through @import directives in LESS compilation of backend cus
  • GHSA-42vx-43vc-x6pr / CVE-2026-57570 (laravel-backpack/crud, access_control, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-pare
  • GHSA-3277-h8g9-qj5f / CVE-2026-54256 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attach
  • GHSA-mrc5-3mm3-45c5 / CVE-2026-54182 (laravel-backpack/crud, injection/output_encoding, 2026-08-20): taken as backpack-stats-host-header-cmdi. Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-control
  • GHSA-mmg4-322v-6jvc / CVE-2026-54181 (laravel-backpack/crud, output_encoding, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). Laravel Backpack CRUD: Stored XSS in the color column — the @if($column['escaped']) bran
  • GHSA-vgmv-8xjc-6rch / CVE-2026-54180 (laravel-backpack/crud, access_control, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reo
  • GHSA-8hw4-7qjr-3wxg / CVE-2026-54179 (laravel-backpack/crud, output_encoding, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a data:image _
  • GHSA-8xjm-wqrp-2f25 / CVE-2026-54178 (laravel-backpack/crud, access_control/path, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear[] in H_
  • GHSA-c8qc-wf67-342w / CVE-2026-61807 (grokability/snipe-it, output_encoding, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Stored DOM XSS via table selected-count IDs
  • GHSA-r9r3-g9fp-3q4q / CVE-2026-55703 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
  • GHSA-3hgv-jr5j-cg9x / CVE-2026-55694 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
  • GHSA-c6w2-j4wq-mvwg / CVE-2026-55643 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
  • GHSA-7gww-x7fh-jf9j (librenms/librenms, output_encoding/untrusted_destination, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig pag
  • GHSA-7cj5-v4pp-v632 (librenms/librenms, output_encoding, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). _LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all _
  • GHSA-jf24-8g2h-2wg7 (librenms/librenms, injection, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). LibreNMS Vulnerable to Remote Code Execution via AboutController
  • GHSA-w27m-rmmf-g5w4 / CVE-2026-54348 (froxlor/froxlor, injection, 2026-08-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Froxlor: Second-Order SQL Injection via Admins.add ipaddress Parameter Allows Full Dat
  • GHSA-43gm-9rr3-cx7g / CVE-2026-54347 (froxlor/froxlor, output_encoding, 2026-08-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
  • GHSA-pcw8-m77r-2528 / CVE-2026-54133 (jmespath/jmespath.php, injection/output_encoding, 2026-08-18): general-purpose library: the attacker source lies in the calling application, not in the repo. jmespath.php has CompilerRuntime code injection via unescaped function names
  • GHSA-c9fv-cgmm-2wg7 / CVE-2026-55182 (librenms/librenms, injection, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
  • GHSA-q8cg-5m48-5c25 (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media URL
  • GHSA-9pr6-8r9w-wvmj (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired _
  • GHSA-993v-76jg-67xr (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detec
  • GHSA-fwwx-3362-3947 (, injection, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated an
  • GHSA-2rhw-8953-48q3 (, path, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Ch
  • GHSA-59xm-4m8c-g3xj / CVE-2026-55224 (mineadmin/mineadmin, path, 2026-08-18): taken as mineadmin-appstore-identifier-traversal. MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninst
  • GHSA-cgvr-f65r-pjv3 (, output_encoding, 2026-08-14): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Stored XSS via quoted-attribute bypass in detectXss
  • GHSA-wvxr-6v52-gfmh (, injection, 2026-08-14): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS
  • GHSA-2mhj-fhvg-v428 / CVE-2026-55072 (pimcore/pimcore, injection, 2026-08-13): repo over ~150 MB (534 MB per GitHub API). Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php u
  • GHSA-6pvm-2vjj-rx4w / CVE-2026-47132 (thorsten/phpmyfaq, injection, 2026-08-12): repo in used list (already referenced under benchmarks/src/tests/.kiro). phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumer
  • GHSA-jmqm-f8q4-v7wx / CVE-2026-45694 (librenms/librenms, output_encoding, 2026-08-12): repo over ~150 MB (369 MB per GitHub API). LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.ti
  • GHSA-j5jq-cr68-v2xx / CVE-2026-35445 (wintercms/winter, access_control, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Authenticated backend users can bypass Users controller permission checks
  • GHSA-m7jc-g4rc-jmvh / CVE-2026-32593 (wintercms/winter, injection, 2026-08-12): taken as winter-filter-numberrange-sqli. Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
  • GHSA-vgp4-2fc4-qff2 / CVE-2026-32258 (wintercms/winter, output_encoding, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Stored XSS through Editor Settings custom styles
  • GHSA-v7cf-8gh9-gxmj / CVE-2026-32257 (wintercms/winter, output_encoding, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). Winter: Stored XSS through Brand Settings custom styles
  • GHSA-4hc4-qjfx-wjf3 (, access_control, 2026-08-11): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify _
  • GHSA-9w6w-8x3c-hfqp (, path, 2026-08-11): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path tr
  • GHSA-hhmc-q9hp-r662 / CVE-2026-63222 (codeigniter4/codeigniter4, path, 2026-08-07): repo over ~150 MB (387 MB per GitHub API). CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
  • GHSA-c9w5-rwh3-7pm9 / CVE-2026-63221 (codeigniter4/codeigniter4, injection, 2026-08-07): repo over ~150 MB (387 MB per GitHub API). CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() condition
  • GHSA-rjhh-76wf-8xmw / CVE-2026-62996 (smarty-php/smarty, path, 2026-08-07): general-purpose library: the attacker source lies in the calling application, not in the repo. Smarty Security stream restriction bypass through stream: resource
  • GHSA-f6wf-28g6-769x / CVE-2026-62992 (smarty-php/smarty, path, 2026-08-07): general-purpose library: the attacker source lies in the calling application, not in the repo. Smarty: Symlink path traversal out of trusted directories
  • GHSA-xxpx-f366-4xpq / CVE-2026-72785 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Authorization bypass: view-only Categories user can modify category structure v
  • GHSA-rvmm-v933-jgxq / CVE-2026-14794 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Missing authorization check allows non-admin control panel users access to user
  • GHSA-7hxc-f267-h5q7 / CVE-2026-72783 (craftcms/cms, path, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Incorrect path validation could potentially lead to path traversal
  • GHSA-2rp4-x2j7-qmcc (craftcms/cms, output_encoding, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Stored XSS in the control panel via unescaped draft name
  • GHSA-hmqg-cxww-wqhq / CVE-2026-67434 (phpcsstandards/php_codesniffer, injection, 2026-08-06): repo over ~150 MB (210 MB per GitHub API). PHP_CodeSniffer gitblame report command injection via crafted filename
  • GHSA-p8x7-9vfw-p7vc (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Arbitrary user password reset leading to administrator account takeover
  • GHSA-9p7c-v5x3-rfx8 / CVE-2026-14793 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Missing authorization check allows non-admin control panel users to reorder Glo
  • GHSA-29pj-957v-52mc / CVE-2026-71478 (thephpleague/commonmark, output_encoding, 2026-08-06): general-purpose library: the attacker source lies in the calling application, not in the repo. league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded con
  • GHSA-grm4-wm43-9jh5 / CVE-2026-55825 (contao/contao, path, 2026-08-06): repo in used list (already referenced under benchmarks/src/tests/.kiro). Contao: Possible path traversal in job download URIs
  • GHSA-w3cp-g2pf-65wh / CVE-2026-54717 (silverstripe/silverstripe-cms, output_encoding, 2026-08-06): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) (breadcrumbs in page list view). Silverstripe: XSS in breadcrumbs in page list view
  • GHSA-vx89-p3j7-8xqc / CVE-2026-71435 (statamic/cms, output_encoding, 2026-08-06): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) ('automagic' form notification email). Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
  • GHSA-qh8c-7588-qfrv / CVE-2026-64662 (statamic/cms, access_control, 2026-08-06): advisory names no vulnerable file or function (a sites entry cannot be declared from its text). Statamic: Missing authorization on navigation endpoint allows disclosure of restricted ent
  • GHSA-225x-3jhx-wh4q / CVE-2026-64664 (statamic/cms, access_control, 2026-08-06): advisory names no vulnerable file or function (a sites entry cannot be declared from its text). Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existe
  • GHSA-v5mv-p594-2x33 / CVE-2026-69246 (guzzle/guzzle, untrusted_destination, 2026-08-03): general-purpose library: the attacker source lies in the calling application, not in the repo. Guzzle: Noncanonical host can bypass host-based checks
  • GHSA-vj8j-973f-r65j (, injection, 2026-08-03): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allow
  • GHSA-mmwh-j75q-gxp8 (, path, 2026-08-03): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disc
  • GHSA-x83g-979r-f5fh / CVE-2026-68501 (sylius/mollieplugin, access_control, 2026-07-31): taken as sylius-mollie-thankyou-order-idor. Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
  • GHSA-rc52-c4hv-w89p / CVE-2026-68500 (sylius/mollieplugin, access_control, 2026-07-31): one case per repository (repository taken as sylius-mollie-thankyou-order-idor). Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
  • GHSA-996f-334j-67g7 / CVE-2026-52838 (alextselegidis/easyappointments, output_encoding, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — St
  • GHSA-8hm4-r66f-29wr / CVE-2026-52841 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). _Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend _
  • GHSA-xgr6-pqjv-3pf8 / CVE-2026-52837 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
  • GHSA-w8xc-8g92-v77h / CVE-2026-52839 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). Easy!Appointments appointments/store and appointments/update allow cross-provider appointm
  • GHSA-pm5p-7w5h-jm5q / CVE-2026-52840 (alextselegidis/easyappointments, untrusted_destination, 2026-07-29): taken as easyappointments-caldav-ssrf. Easy!Appointments has server-side request forgery in CalDAV connection test that exposes t
  • GHSA-3735-5339-xfwx / CVE-2026-54588 (poweradmin/poweradmin, untrusted_destination, 2026-07-28): repo over ~150 MB (508 MB per GitHub API). Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Re
  • GHSA-3pwp-g2mj-5p3v / CVE-2026-45293 (wordpress/wordpress-coding-standards, injection, 2026-07-28): developer tool / CLI, not a web application. WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilit
  • GHSA-rm67-g9ch-vxff (poweradmin/poweradmin, access_control, 2026-07-24): repo over ~150 MB (508 MB per GitHub API). Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones t
  • GHSA-h4hf-v6w5-897x (poweradmin/poweradmin, access_control, 2026-07-24): repo over ~150 MB (508 MB per GitHub API). Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and ta
  • GHSA-g3hq-hphg-8fhh (pheditor/pheditor, injection, 2026-07-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — survivin
  • GHSA-6hq5-7373-42rg / CVE-2026-59931 (phpoffice/phpspreadsheet, untrusted_destination, 2026-07-23): general-purpose library: the attacker source lies in the calling application, not in the repo. PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
  • GHSA-cx96-42px-69fm / CVE-2026-56722 (dompdf/dompdf, path, 2026-07-22): general-purpose library: the attacker source lies in the calling application, not in the repo. Dompdf: Local file read due to improper file path validation in SVG images encoded as data
  • GHSA-wvh6-f5jh-8gw4 / CVE-2026-55554 (dompdf/dompdf, path, 2026-07-22): general-purpose library: the attacker source lies in the calling application, not in the repo. Dompdf: Chroot Validation Bypass
  • GHSA-gjfg-22fp-rrxx / CVE-2026-59946 (composer/composer, path, 2026-07-20): developer tool / CLI, not a web application. Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
  • GHSA-499r-g7pc-vmp9 / CVE-2026-59948 (composer/composer, path, 2026-07-20): developer tool / CLI, not a web application. Composer: Arbitrary file write outside vendor via malicious transitive package name
  • GHSA-cvpc-hccg-wmw4 (verbb/formie, access_control, 2026-07-17): repo in used list (already referenced under benchmarks/src/tests/.kiro). Formie: Missing authorization in administrative settings allows low-privileged CP users to
  • GHSA-wg4w-wr5q-6vjc / CVE-2026-55578 (pheditor/pheditor, injection, 2026-07-16): repo in used list (already referenced under benchmarks/src/tests/.kiro). Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator
  • GHSA-9643-6xjp-vx57 / CVE-2026-54540 (pheditor/pheditor, injection, 2026-07-16): repo in used list (already referenced under benchmarks/src/tests/.kiro). Pheditor has an authenticated terminal command whitelist bypass
  • GHSA-373m-p57p-8665 (, output_encoding, 2026-07-15): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
  • GHSA-h2wf-967x-gxvw / CVE-2026-62944 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: Stored XSS in print_all_bug_page_word.php
  • GHSA-3v2j-6fw9-f57c / CVE-2026-52882 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
  • GHSA-vcrw-4xvv-jh49 / CVE-2026-52881 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: Reflected XSS in admin/install.php via unescaped printf _
  • GHSA-77x8-3v3h-hrhv / CVE-2026-52847 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: Reflected XSS in admin/install.php
  • GHSA-rjg7-r26h-cfp2 / CVE-2026-54494 (koel/koel, untrusted_destination, 2026-07-15): taken as koel-podcast-enclosure-ipv6-ssrf. Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not r
  • GHSA-jr4p-4xjh-fwvw / CVE-2026-50552 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validati
  • GHSA-6qvr-wjmv-v8mm / CVE-2026-54491 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
  • GHSA-8q6q-m837-fv64 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _ Koel has SSRF through Authenticated Subsonic podcast feed URLs_
  • GHSA-6p96-cfg5-4vhp / CVE-2026-54493 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
  • GHSA-w79m-f3jx-779v / CVE-2026-54492 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
  • GHSA-m7ph-9558-mrx3 / CVE-2026-49280 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: REST API unauthorized Issue status change
  • GHSA-v84x-qvhg-f36r / CVE-2026-49273 (mantisbt/mantisbt, injection, 2026-07-15): taken as mantisbt-tokenizer-eval-rce. MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
  • GHSA-c2xg-qjqw-2v98 / CVE-2026-47156 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
  • GHSA-mw6p-33vw-46cc / CVE-2026-47142 (mantisbt/mantisbt, injection, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). MantisBT: SQL Injection via history_order Configuration Value
  • GHSA-hgjx-r89m-m7v4 (neorazorx/facturascripts, path, 2026-07-14): taken as facturascripts-uploadedfile-move-traversal. FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbit
  • GHSA-8559-gwj3-q37r / CVE-2026-54087 (easycorp/easyadminbundle, output_encoding, 2026-07-14): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (uploads must be stored under the public web root); the flaw is a missing default upload restriction, with no rendering sink in the repository. EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField
  • GHSA-3x7p-v8hj-xh5m / CVE-2026-45710 (neorazorx/facturascripts, output_encoding, 2026-07-14): one case per repository (repository taken as facturascripts-uploadedfile-move-traversal). FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attr
  • GHSA-cv65-7cg8-r623 / CVE-2026-45693 (neorazorx/facturascripts, path, 2026-07-14): one case per repository (repository taken as facturascripts-uploadedfile-move-traversal). FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private My
  • GHSA-5qmh-x653-g8qj / CVE-2026-45262 (neorazorx/facturascripts, injection/untrusted_destination, 2026-07-14): no fixed version stated (<= 2026.1, patched: none) and no identifiable fix: the only candidate (14ee211c, 'centralizar parseFieldFilter con validación anti-SQLi') was reverted the same day (7392b489). FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter paramete
  • GHSA-rw46-qg69-vg6h / CVE-2026-52828 (kimai/kimai, access_control, 2026-07-14): no fix commit referenced; per the v2 research, Kimai's fixes for this release shipped in the single 'Release 2.58' commit (31a8f887, 120 files across 2.57.0...2.58.0), mixed with unrelated changes. Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
  • GHSA-2xgg-2x8h-8xw4 / CVE-2026-52826 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allow
  • GHSA-xv4r-4885-gwpg / CVE-2026-52825 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Al
  • GHSA-c6w6-57jj-62vh / CVE-2026-52822 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets Afte
  • GHSA-3q6q-26vg-v97x / CVE-2026-52821 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creatio
  • GHSA-xv8g-76mx-2rxc / CVE-2026-49970 (plank/laravel-mediable, path, 2026-07-13): general-purpose library: the attacker source lies in the calling application, not in the repo. Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
  • GHSA-4chg-4752-w88r / CVE-2026-55372 (nukeviet/nukeviet, untrusted_destination, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). NukeViet: Pre-authentication SSRF via X-Forwarded-Host
  • GHSA-c9xg-64p9-f2jj / CVE-2026-54065 (nukeviet/nukeviet, path, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
  • GHSA-465g-4q99-5x86 / CVE-2026-54064 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
  • GHSA-w2w5-w2pw-r929 / CVE-2026-49259 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
  • GHSA-mxpf-qgg6-v3ff / CVE-2026-48118 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). NukeViet: Unauthenticated Reflected XSS in Comment Module
  • GHSA-vrr2-g9gh-c3jc / CVE-2026-52820 (kimai/kimai, access_control, 2026-07-13): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_buil
  • GHSA-4m8q-55qv-9pwp / CVE-2026-52819 (kimai/kimai, access_control, 2026-07-13): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' ti
  • GHSA-qv4m-m73m-8hj7 (notrinos/notrinoserp, path, 2026-07-10): no fixed version stated and no identifiable fix commit (the history of hrm/manage/employees.php shows no matching change); the weakness is also mainly unrestricted upload (CWE-434). NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM em
  • GHSA-pj8j-p4g4-4vw8 / CVE-2026-49865 (kimai/kimai, untrusted_destination, 2026-07-10): no fix commit referenced; the fix is in Kimai's 'Release 2.58' squash (see above). Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
  • GHSA-pjhx-3c3w-9v23 / CVE-2026-49858 (api-platform/core, access_control, 2026-07-10): a per-process cache-key bug in the serializer; exposure depends on application-declared #[ApiProperty(security: ...)] predicates, and no attacker-controlled value reaches the flaw inside the repository. API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normali
  • GHSA-mr9r-h354-966r / CVE-2026-53639 (sylius/sylius, access_control, 2026-07-09): repo over ~150 MB (355 MB per GitHub API). Sylius: IDOR on Shop Payment Request API endpoints
  • GHSA-6955-hrm5-c4qp / CVE-2026-53638 (sylius/sylius, access_control, 2026-07-09): repo over ~150 MB (355 MB per GitHub API). Sylius: Channel-based payment method restriction bypass on shop account orders API endpoin
  • GHSA-px5m-h76g-p7p8 / CVE-2026-52778 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Den
  • GHSA-9369-69wj-7m2f / CVE-2026-52777 (yeswiki/yeswiki, deserialization, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserial
  • GHSA-4pf7-cc4r-g63h / CVE-2026-52775 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki has Authenticated SQL Injection via ReactionManager _
  • GHSA-r5xw-gcgw-hwp5 / CVE-2026-52774 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki Vulnerable to Reflected XSS via Unescaped id Parameter in Bazar Widget HTML Attr
  • GHSA-35f3-pg38-486f / CVE-2026-52773 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision time Parameter in `h
  • GHSA-xc7j-3g8q-9vh4 / CVE-2026-52772 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hin
  • GHSA-8f2v-2qhj-gfwg / CVE-2026-52771 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiControl
  • GHSA-qg78-vmvc-fhjw / CVE-2026-52770 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query
  • GHSA-vw42-752g-5mrp / CVE-2026-52769 (yeswiki/yeswiki, untrusted_destination, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId
  • GHSA-6x7x-gcmf-7r8x / CVE-2026-52766 (yeswiki/yeswiki, access_control, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}
  • GHSA-89v6-j5x6-cmj3 / CVE-2026-52763 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki: SQL injection via the recentchanges action period argument leads to arbitrary
  • GHSA-65p8-9433-jpcp / CVE-2026-52762 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via
  • GHSA-w9mx-xmg4-gc4r / CVE-2026-53932 (stefanzweifel/laravel-backup-restore, injection, 2026-07-09): developer tool / CLI, not a web application. laravel-backup-restore has an OS Command Injection during database restore
  • GHSA-86vw-x4ww-x467 / CVE-2026-56382 (craftcms/cms, injection, 2026-07-09): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
  • GHSA-c43v-4cr8-6mvp / CVE-2026-56394 (craftcms/cms, path, 2026-07-09): repo over ~150 MB (1048 MB per GitHub API). Craft CMS has authenticated path traversal in assets/icon, allowing local .svg file re
  • GHSA-4wj4-79rr-pvff (, output_encoding, 2026-07-08): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Stored CSS injection via Markdown image resize() bypasses prior _
  • GHSA-vmwx-m75v-qvch / CVE-2026-53634 (code16/sharp, access_control, 2026-07-08): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) ('create and store endpoints of the Quick Creation Command feature'). Sharp Missing Authorization Check in Quick Creation Command Endpoints
  • GHSA-c8m7-r2jv-rw63 / CVE-2026-45016 (egroupware/egroupware, path, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose
  • GHSA-8737-2x9g-xjj7 / CVE-2026-40187 (egroupware/egroupware, injection, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). EGroupware has Authenticated RCE via Malicious eTemplate Upload
  • GHSA-h9qx-v5xp-ph8p / CVE-2026-27823 (egroupware/egroupware, access_control/injection/path, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). EGroupware has a Remote Code Execution Vulnerability
  • GHSA-f74w-488g-8x5r / CVE-2026-55794 (craftcms/cms, injection, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
  • GHSA-xrqc-p465-2xvg / CVE-2026-55793 (craftcms/cms, output_encoding, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Stored XSS via Structure entry title in table view
  • GHSA-24x4-j6x9-rfw5 / CVE-2026-55790 (craftcms/cms, output_encoding, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
  • GHSA-x76w-8c62-48mg / CVE-2026-56384 (craftcms/cms, access_control, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform previe
  • GHSA-565m-g33j-jq96 / CVE-2026-52889 (verbb/formie, injection, 2026-07-06): repo in used list (already referenced under benchmarks/src/tests/.kiro). Formie Hidden field defaults vulnerable to Server-Side Template Injection
  • GHSA-rqjw-r5g4-x8qm (, access_control, 2026-07-06): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel _
  • GHSA-3w32-23wj-rxg3 / CVE-2026-50282 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
  • GHSA-5hvg-w58j-545m / CVE-2026-9811 (mautic/mautic, output_encoding, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
  • GHSA-7h65-whp7-rgqf / CVE-2026-9809 (mautic/mautic, output_encoding, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
  • GHSA-2jrw-c95w-h43g / CVE-2026-9808 (mautic/mautic, access_control, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic has an Authorization Bypass in API v2 Endpoints
  • GHSA-6r9h-4h75-7q4x / CVE-2026-9559 (mautic/mautic, path, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic vulnerable to Path Traversal via Campaign Import
  • GHSA-9fx4-7cmj-47vg / CVE-2026-9558 (mautic/mautic, injection, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic has Server-Side Template Injection (SSTI) in Theme Templates
  • GHSA-jmv8-8j9j-rcpc / CVE-2026-9557 (mautic/mautic, untrusted_destination, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic Focus component Vulnerable to SSRF
  • GHSA-fcmw-wx57-9p75 / CVE-2026-4776 (mautic/mautic, injection, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). Mautic has SQL Injection in API Contact Filtering
  • GHSA-q4rm-m6xh-5pv7 (froxlor/froxlor, access_control, 2026-07-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
  • GHSA-7h62-6v23-v8fm / CVE-2026-50284 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Missing peer-permission check in AssetsController::actionDeleteFolder allows _
  • GHSA-qh45-9g5p-m2v4 / CVE-2026-50283 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
  • GHSA-43cq-c2gq-pfpw / CVE-2026-50280 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Authorization bypass in entries/move-to-section via missing target-section sa
  • GHSA-qq2c-2q8j-jh27 / CVE-2026-50279 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). Craft CMS: Authorship spoofing in entries/save-entry via pre-check/post-mutation authori
  • GHSA-4h7g-5542-v3fc / CVE-2026-52854 (professionalwiki/maps, output_encoding, 2026-07-02): excluded by name. mediawiki/maps has stored XSS through the overlays parameter in the display_map parser fun
  • GHSA-j5mc-p8qg-39j7 (kimai/kimai, access_control, 2026-07-02): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
  • GHSA-529h-vh3j-85hq / CVE-2026-49981 (twigphp/twig, access_control, 2026-07-01): general-purpose library: the attacker source lies in the calling application, not in the repo. Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes betwee
  • GHSA-hwmc-r6mf-jh83 (spatie/schema-org, output_encoding, 2026-07-01): general-purpose library: the attacker source lies in the calling application, not in the repo. Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
  • GHSA-2wwr-9x6f-88gp (easycorp/easyadminbundle, output_encoding/path, 2026-07-01): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (the advisory says the bundle's own first-party usage is not affected). EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
  • GHSA-h8vq-8gpg-mhcg / CVE-2026-48808 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. Twig: Sandbox property allowlist bypass via the column filter under `SourcePolicyInterfa
  • GHSA-8x9c-rmqh-456c / CVE-2026-48807 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. Twig: Sandbox __toString() policy bypass via Traversable in join and replace filte
  • GHSA-5v5v-ww74-355v / CVE-2026-48806 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. Twig: Sandbox __toString() policy bypass via dynamic mapping keys
  • GHSA-5q4q-834j-g8g4 / CVE-2026-47198 (paymenter/paymenter, access_control, 2026-06-30): taken as paymenter-checkout-config-override. Paymenter has URL parameter injection that bypasses paid plan limits at checkout
  • GHSA-7vfx-4246-jcfh (solidinvoice/solidinvoice, access_control, 2026-06-26): repo over ~150 MB (151 MB per GitHub API). SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens an
  • GHSA-x8g9-h984-pc36 / CVE-2026-49359 (pontedilana/php-weasyprint, untrusted_destination, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
  • GHSA-5g9f-cwwg-4p8g / CVE-2026-49358 (pontedilana/php-weasyprint, path, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
  • GHSA-2fmj-p74r-3wjm / CVE-2026-49286 (pontedilana/php-weasyprint, deserialization, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-
  • GHSA-f5gc-qxf8-mh9g / CVE-2026-49260 (pontedilana/php-weasyprint, injection, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inv
  • GHSA-7mqq-4v55-88gh / CVE-2026-54244 (statamic/cms, access_control, 2026-06-26): advisory names no vulnerable file or function (a sites entry cannot be declared from its text). Statamic CMS's incorrect authorization lets view-only users submit Live Preview content re
  • GHSA-v5c4-wcpj-x73m / CVE-2026-54242 (statamic/cms, untrusted_destination, 2026-06-26): advisory names no vulnerable file or function (a sites entry cannot be declared from its text) (Glide image proxy). Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
  • GHSA-2497-6pwj-pwg7 / CVE-2026-49288 (statamic/cms, access_control, 2026-06-26): advisory names no vulnerable file or function (a sites entry cannot be declared from its text). Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure
  • GHSA-mmj8-wcvw-6789 / CVE-2026-49262 (aimeos/pagible, untrusted_destination, 2026-06-26): taken as pagible-admin-proxy-dns-rebinding-ssrf. Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in a
  • GHSA-wpvj-hjcr-h3p2 / CVE-2026-48820 (cakephp/cakephp, path, 2026-06-26): framework View::element(); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (the advisory: 'if developers are not using user-supplied data in element names, no action is required'). CakePHP: View::element() is missing a path containment check
  • GHSA-6mmj-jhqj-6c6q / CVE-2026-55542 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL _
  • GHSA-x667-r589-43m7 / CVE-2026-55519 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has Improper Authorization in File Deletion (IDOR)
  • GHSA-hf68-g98v-wp9g / CVE-2026-55483 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Cre
  • GHSA-33g4-646g-qwmm / CVE-2026-55482 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
  • GHSA-6x4j-8954-5hxm / CVE-2026-50550 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT has a 2FA reset privilege bypass
  • GHSA-p68w-rgmg-3c2v / CVE-2026-49976 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT Vulnerable to User Account Escalation via CSV Import
  • GHSA-8c6h-7g6x-m5x4 / CVE-2026-49205 (thorsten/phpmyfaq, access_control, 2026-06-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete _
  • GHSA-6f75-x745-xcpr / CVE-2026-48507 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT: Bulk editing users allowed ldap_import and activated_in bulk editing users
  • GHSA-44wp-g8f4-f4v5 / CVE-2026-48500 (filamentphp/filament, access_control, 2026-06-23): repo over ~150 MB (582 MB per GitHub API). Filament: Unauthenticated temporary file upload on auth pages
  • GHSA-52fw-7fw2-fmv5 / CVE-2026-48493 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
  • GHSA-f3c5-6cw8-fg57 / CVE-2026-48492 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). Snipe-IT's selectlist visibility is too permissive
  • GHSA-3fc8-8hp6-6jr4 / CVE-2026-48167 (filamentphp/filament, output_encoding, 2026-06-23): repo over ~150 MB (582 MB per GitHub API). Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
  • GHSA-7cqp-7cfv-6c3q (wwbn/avideo, output_encoding, 2026-06-23): repo over ~150 MB (664 MB per GitHub API). _AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in _
  • GHSA-wc3f-xc32-435f / CVE-2026-55173 (wwbn/avideo, injection, 2026-06-23): repo over ~150 MB (664 MB per GitHub API). AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a singl
  • GHSA-32fw-h446-j4hh (, untrusted_destination, 2026-06-23): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload
  • GHSA-53h4-8rc4-f539 / CVE-2026-48157 (slimphp/slim, output_encoding, 2026-06-23): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (only apps that pass request data to HttpException::setTitle()/setDescription()). Slim has Reflected XSS in the HtmlErrorRenderer
  • GHSA-8j8m-p79x-g4jm / CVE-2026-33684 (wwbn/avideo, access_control, 2026-06-22): repo over ~150 MB (664 MB per GitHub API). AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Sel
  • GHSA-x93q-x9pc-w5hw / CVE-2026-44585 (paymenter/paymenter, access_control, 2026-06-22): one case per repository (repository taken as paymenter-checkout-config-override). Paymenter has broken object level authorization via service reference manipulation on tick
  • GHSA-f95g-vm94-46c3 (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
  • GHSA-jcmp-jxh2-4jc3 (, path, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS has authenticated path traversal in assets/icon, allowing _
  • GHSA-f4h3-qhg5-j6mq (, access_control, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows user
  • GHSA-9r7j-7jhg-4f4c (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permiss
  • GHSA-5w9j-w5p8-r4p7 (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Ty
  • GHSA-xj2c-g5xp-4p47 (, access_control, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallb
  • GHSA-pmm4-v8f6-4vpp (, injection, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRe
  • GHSA-xj9w-cgqg-q897 (wwbn/avideo, access_control, 2026-06-20): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
  • GHSA-rg7q-4223-phjw (, access_control, 2026-06-20): duplicate advisory (GitHub marks it "Duplicate Advisory"). Duplicate Advisory: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exp
  • GHSA-5c7p-g73q-rpg5 / CVE-2026-55692 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideo
  • GHSA-7h5p-637f-jfr7 / CVE-2026-55691 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
  • GHSA-c29q-5xm7-5p62 / CVE-2026-55690 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exceptio
  • GHSA-vm85-hxw5-5432 / CVE-2026-55766 (guzzle/psr7, output_encoding, 2026-06-19): general-purpose library: the attacker source lies in the calling application, not in the repo. guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
  • GHSA-9qfv-wgh2-m6p8 / CVE-2026-55374 (jleehr/canto-saas-api, untrusted_destination, 2026-06-19): general-purpose library: the attacker source lies in the calling application, not in the repo. canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
  • GHSA-p9xj-fpr2-jf2q / CVE-2026-55878 (symfony/ux, path, 2026-06-19): developer tool: the ux:install console command, not a web request path. symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe
  • GHSA-6v8j-33hc-mv84 / CVE-2026-55877 (symfony/ux, output_encoding, 2026-06-19): the source is icon files or a configured Iconify endpoint, not a request; no fix commit referenced. symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand res
  • GHSA-mwqm-4fw3-cjvr / CVE-2026-49216 (symfony/ux, output_encoding, 2026-06-19): the sink is the Stimulus (JavaScript) controller's template literal, not PHP. symfony/ux-autocomplete: XSS via unescaped AJAX response data
  • GHSA-38x5-rcv4-xf7x / CVE-2026-49210 (symfony/ux, output_encoding, 2026-06-19): taken as symfony-ux-live-child-tag-xss. symfony/ux-live-component: XSS via attacker-controlled child component tag
  • GHSA-r3w8-2c5r-h9j9 / CVE-2026-54005 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: pages.access permission is not checked in the site/find REST API route
  • GHSA-89cp-7p28-jffg / CVE-2026-54004 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: Access to files of top-level drafts is not protected by permissions
  • GHSA-wr9h-4r83-f4v6 / CVE-2026-54002 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize(
  • GHSA-4v4h-m2qq-ppgw / CVE-2026-50188 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: Request header injection in Http\Remote
  • GHSA-rhj6-r49h-5932 / CVE-2026-49276 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: Self cross-site scripting (self-XSS) in the writer field
  • GHSA-23q2-54qv-rq5x / CVE-2026-49274 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). Kirby: pages.access permission is not checked in the pages picker for parent pages
  • GHSA-pmf8-g7c8-7v54 / CVE-2026-55890 (getgrav/grav, output_encoding, 2026-06-18): one case per repository (repository taken as grav-blueprint-bare-function-rce). Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() —
  • GHSA-7p36-fq2r-4h7r / CVE-2026-11407 (pimcore/pimcore, injection, 2026-06-17): repo over ~150 MB (534 MB per GitHub API). Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
  • GHSA-m9cv-24rx-8mv7 / CVE-2026-55409 (filamentphp/filament, output_encoding, 2026-06-17): repo over ~150 MB (582 MB per GitHub API). Filament: Disabled RichEditor field state can be used for XSS
  • GHSA-m557-wrgg-6rp4 / CVE-2026-55599 (phpseclib/phpseclib, untrusted_destination, 2026-06-16): general-purpose library: the attacker source lies in the calling application, not in the repo. phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (serve
  • GHSA-9mmg-q95p-gp67 / CVE-2026-50886 (firefly-iii/firefly-iii, access_control, 2026-06-15): repo over ~150 MB (313 MB per GitHub API). Project Firefly III has incorrect access control in the webhook management component
  • GHSA-h5x3-xfc9-m39h / CVE-2026-48784 (symfony/symfony, untrusted_destination, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained ../ or ./ → Gener
  • GHSA-38cx-cq6f-5755 / CVE-2026-48736 (symfony/symfony, untrusted_destination, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-c
  • GHSA-6h46-9jf5-q59x / CVE-2026-48489 (symfony/symfony, access_control, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access t
  • GHSA-x5qj-865h-mgvm / CVE-2026-48761 (symfony/symfony, output_encoding, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
  • GHSA-vv4x-qcpq-wgrg / CVE-2026-12198 (microweber/microweber, path, 2026-06-15): repo over ~150 MB (1185 MB per GitHub API). Microweber vulnerable to Path Traversal
  • GHSA-pjpj-v387-x4vq / CVE-2026-11607 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in its Form Framework
  • GHSA-f34x-rx2w-7pm3 / CVE-2026-47349 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in the Recycler Module
  • GHSA-3p42-w5ch-gg42 / CVE-2026-47347 (typo3/typo3, untrusted_destination, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
  • GHSA-3v8v-4wg6-r7qh / CVE-2026-47343 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS: Destructive Actions on File Mount Folders
  • GHSA-p5j5-4j3q-8mq8 / CVE-2026-47345 (typo3/html-sanitizer, output_encoding, 2026-06-12): general-purpose library: the attacker source lies in the calling application, not in the repo. TYPO3 HTML Sanitizer allows Cross-site Scripting
  • GHSA-jh32-v29g-68pq / CVE-2026-49741 (typo3/typo3, access_control/injection, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
  • GHSA-qcmw-6rm2-5x78 / CVE-2026-47350 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in its DataHandler
  • GHSA-hwvq-2w67-rvxp / CVE-2026-47346 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in its Form Framework
  • GHSA-chm7-4vch-h8vr / CVE-2026-49742 (typo3/typo3, path, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in its Media Module
  • GHSA-c78m-c52x-jgwp / CVE-2026-49740 (typo3/typo3, deserialization, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Insecure Deserialization via Core API
  • GHSA-jf56-v8jc-jcc5 / CVE-2026-49738 (typo3/typo3, path, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in its File Abstraction Layer
  • GHSA-2j54-93q2-3hjq / CVE-2026-47352 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Broken Access Control in Backend API
  • GHSA-q93m-25xv-94hh / CVE-2026-47351 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS: Broken Access Control in Media Module
  • GHSA-cg75-qfg2-w9hj / CVE-2026-47348 (typo3/typo3, output_encoding, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). TYPO3 CMS has Cross-Site Scripting in Indexed Search
  • GHSA-jvf5-rxvv-3mcg / CVE-2026-47344 (typo3/html-sanitizer, output_encoding, 2026-06-12): general-purpose library: the attacker source lies in the calling application, not in the repo. TYPO3 HTML Sanitizer allows Cross-site Scripting
  • GHSA-6jq6-x4cx-qvcm (firefly-iii/firefly-iii, output_encoding, 2026-06-12): repo over ~150 MB (313 MB per GitHub API). Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
  • GHSA-7q3w-xqjw-g3cr / CVE-2026-48067 (filamentphp/filament, access_control, 2026-06-11): repo over ~150 MB (582 MB per GitHub API). Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Selec
  • GHSA-34xg-wgjx-8xph / CVE-2026-48998 (guzzle/psr7, untrusted_destination, 2026-06-11): general-purpose library: the attacker source lies in the calling application, not in the repo. guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
  • GHSA-hq7v-mx3g-29hw / CVE-2026-49214 (guzzle/psr7, output_encoding, 2026-06-11): general-purpose library: the attacker source lies in the calling application, not in the repo. guzzlehttp/psr7 has CRLF Injection via URI Host Component
  • GHSA-q8r6-5hfw-5jff / CVE-2026-53723 (guzzle/guzzle-services, injection, 2026-06-11): general-purpose library (guzzlehttp/guzzle-services XML serialization); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDAT
  • GHSA-g82f-9pw7-773w / CVE-2026-10721 (concretecms/concretecms, deserialization, 2026-06-10): repo over ~150 MB (303 MB per GitHub API). Concrete CMS: PHP Object Injection via unserialize() calls
  • GHSA-wmjr-58rf-xgrc / CVE-2026-53675 (buddypress/buddypress, access_control, 2026-06-10): one case per repository (repository taken as wp-buddypress-messages-rest-idor). BuddyPress: Any authenticated attacker can enumerate another user's complete friend list v
  • GHSA-j3j5-5m8v-7gvc / CVE-2026-53673 (buddypress/buddypress, access_control, 2026-06-10): taken as wp-buddypress-messages-rest-idor. BuddyPress: Authenticated attackers can access arbitrary private message threads via user_
  • GHSA-jvc5-6g7q-c843 / CVE-2026-48030 (pheditor/pheditor, injection, 2026-06-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
  • GHSA-pr6f-87hf-hx24 / CVE-2026-50636 (limesurvey/limesurvey, injection, 2026-06-09): repo over ~150 MB (1457 MB per GitHub API). LimeSurvey has a SQL Injection issue
  • GHSA-87m4-826x-3crx / CVE-2026-45034 (phpoffice/phpspreadsheet, deserialization, 2026-06-08): general-purpose library: the attacker source lies in the calling application, not in the repo. _PHPSpreadsheet has a patch bypass for CVE-2026-34084 _
  • GHSA-2g2g-8p8h-fgwm / CVE-2026-47730 (twigphp/twig, output_encoding, 2026-06-05): general-purpose library: the attacker source lies in the calling application, not in the repo. Twig: XSS in profiler HtmlDumper via unescaped template and profile names
  • GHSA-c3qp-2ggw-xjg7 / CVE-2026-47744 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). Shopper: Authorization bypass and RBAC privilege escalation in team settings
  • GHSA-hr9v-r8r2-hg7j / CVE-2026-47743 (shopperlabs/shopper, access_control/output_encoding, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). Shopper: Multiple data integrity and disclosure issues in admin Livewire components
  • GHSA-fxqw-97cc-7g5c / CVE-2026-47745 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin
  • GHSA-h4mp-g9c6-xwph / CVE-2026-47742 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). Shopper: Missing authorization on Product admin Livewire sub-form components
  • GHSA-vg35-5wq7-3x7w / CVE-2026-47761 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object inje
  • GHSA-v98h-vmpc-fpqv / CVE-2026-47762 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). TinyMCE Cross-Site Scripting (XSS) vulnerability through mce:protected comments
  • GHSA-q742-qvgc-gc2f / CVE-2026-47759 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, hre
  • GHSA-mh5m-5hw4-5c69 / CVE-2026-47760 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). _TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested _
  • GHSA-gq96-5pfx-f4vc / CVE-2026-48013 (shopware/shopware, untrusted_destination, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
  • GHSA-xvhc-gm7j-mhmc / CVE-2026-48015 (shopware/shopware, output_encoding, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). Shopware: Stored XSS via SVG file upload — no SVG sanitization
  • GHSA-f8q6-3g5w-jjr6 / CVE-2026-48014 (shopware/shopware, access_control, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). Shopware: Admin API ACL Bypass in Order State Transition Endpoints
  • GHSA-4x3x-869w-xx3m / CVE-2026-48012 (shopware/shopware, untrusted_destination, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). Shopware SSO referer trust leading to an arbitrary redirect target
  • GHSA-gv8p-48fr-4fxg / CVE-2026-48008 (shopware/shopware, access_control, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
  • GHSA-8whc-2wmv-ww35 / CVE-2026-54458 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broad
  • GHSA-66q5-cj5g-wrfx / CVE-2026-50183 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Secti
  • GHSA-hgjh-6wj8-gcgf / CVE-2026-50182 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Unauthenticated Reflected XSS via $GET['search'] in AVideo YouTubeAPI Galler
  • GHSA-2fhx-q92v-5fhv / CVE-2026-49279 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (
  • GHSA-c8h8-vq34-9fw2 / CVE-2026-47694 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). WWBN AVideo: Stored XSS via unescaped Gallery category description
  • GHSA-52pr-7vmf-2w7x / CVE-2026-7888 (concretecms/concretecms, deserialization, 2026-06-03): repo over ~150 MB (303 MB per GitHub API). Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow
  • GHSA-m8xx-3x29-84h8 / CVE-2022-31114 (laravel-backpack/crud, output_encoding, 2026-06-03): one case per repository (repository taken as backpack-stats-host-header-cmdi). backpack/crud is vulnerable to Cross-Site Scripting (XSS)

Passed over (not examined; family quota already met): GHSA-7wwh-xcc3-9fcg (paymenter/paymenter, untrusted_destination, 2026-06-22); GHSA-86hp-hf3j-3m8r (cotonti/cotonti, output_encoding, 2026-06-18); GHSA-hhpq-7wg4-36jm (cakephp/authentication, untrusted_destination, 2026-06-17); GHSA-crmm-hgp2-wgrp (laravel/framework, output_encoding, 2026-06-17); GHSA-gmxh-hjfv-qc2w (benjaminjonard/koillection, untrusted_destination, 2026-06-15); GHSA-p85r-x2wj-mxqj (shlinkio/shlink, untrusted_destination, 2026-06-15); GHSA-wrcg-234w-hfhq (intelliants/subrion, output_encoding, 2026-06-15).

Lane B: unreviewed advisories with a GitHub fix reference on a PHP repository

  • GHSA-84f7-xff5-hx38 / CVE-2022-51019 (akaunting/akaunting, injection, 2026-09-29): republished old vulnerability (CVE-2022-51019, fixed in Akaunting 2.1.31 in 2022), not a 2026 advisory; also advisory names no vulnerable file or function (only 'the alias parameter' of module installation). Akaunting before 2.1.31 contains an OS command injection vulnerability in the module insta
  • GHSA-rv7j-2hq3-r6fq / CVE-2024-58386 (zoneminder/zoneminder, path, 2026-09-29): repo over ~150 MB (161 MB per GitHub API). ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the fil
  • GHSA-gxmj-vr4j-8j5c / CVE-2026-100884 (krayin/laravel-crm, path, 2026-09-28): the named location is not declarable: the advisory (VulDB text) puts 'the function Storage::download' in packages/Webkul/Admin/src/Config/acl.php, a configuration file; the weakness described is an IDOR (CWE-99 'resource identifiers'), not a path. _A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is _
  • GHSA-7q7h-5g76-8cq4 / CVE-2026-100520 (crivion/laranode, path, 2026-09-26): advisory names no vulnerable file or function (only the POST /filemanager/upload-file endpoint and its path parameter). Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /fileman
  • GHSA-vm72-96wq-2ppv / CVE-2026-96744 (mongodb/laravel-mongodb, injection, 2026-09-24): general-purpose library (mongodb/laravel-mongodb cache lock); the attacker source lies in the calling application. Improper neutralization of special elements in data query logic in the cache lock implemen
  • GHSA-c7hm-qgxh-6vgg / CVE-2026-95701 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). _In MISP, the _statisticsOrgs method in UsersController.php used the organization name dir
  • GHSA-24qr-3pqh-xghm / CVE-2026-95698 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenati
  • GHSA-f496-75v4-rv5q / CVE-2026-95693 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name fie
  • GHSA-qjpg-gmh7-3ch6 / CVE-2026-95667 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a
  • GHSA-2jvm-986q-589g / CVE-2026-94401 (misp/misp, path, 2026-09-21): repo over ~150 MB (201 MB). MISP has a file-handling vulnerability that could let certain authenticated users make the
  • GHSA-7c6f-jc48-6hfq / CVE-2026-94106 (jamesheinrich/getid3, injection, 2026-09-20): general-purpose library (getID3 media parser); the attacker source lies in the calling application. _getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers _
  • GHSA-pjph-5h96-886c / CVE-2026-93988 (qloapps/qloapps, path, 2026-09-20): one case per repository (repository taken as qloapps-customermessage-bo-query-sqli). QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action o
  • GHSA-3v3g-3pf9-fgcf / CVE-2026-93872 (cotonti/cotonti, deserialization, 2026-09-18): no fix diff: the referenced PR #1897 is not merged, and plugins/comments/controllers/actions/EditAction.php has no later commit. Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_clas
  • GHSA-q246-734p-8872 / CVE-2026-93533 (spatie/scotty, injection, 2026-09-18): developer CLI (scotty SSH task runner, DoctorCommand), not a web application; the fix PR 'awaits acceptance'. A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function...
  • GHSA-qqx6-v32j-728q / CVE-2026-89036 (appwrite/appwrite, injection, 2026-09-17): repo over ~150 MB (532 MB). Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticat
  • GHSA-2vrr-cgr4-gfmm / CVE-2026-76834 (b2evolution/b2evolution, deserialization, 2026-09-17): repo over ~150 MB (182 MB). b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 w
  • GHSA-6wrp-rq46-2frr / CVE-2026-92970 (hubzero/hubzero-cms, path, 2026-09-17): repo over ~150 MB (359 MB). HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload.
  • GHSA-xv9c-9hwm-jp8g / CVE-2026-91939 (cotonti/cotonti, deserialization, 2026-09-15): no fix diff: the referenced PR #1889 is not merged. Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without...
  • GHSA-63h9-9gmf-c466 / CVE-2020-15875 (librenms/librenms, injection, 2026-09-13): repo over ~150 MB (369 MB). An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv
  • GHSA-6hw9-7gx5-mw88 / CVE-2026-85200 (fitoussi/geo-my-wp, path, 2026-09-12): taken as wp-geo-my-wp-info-window-lfi. The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions u
  • GHSA-hh3c-hgv7-gg2r / CVE-2026-79362 (woltlab/wcf, injection, 2026-09-11): repo over ~150 MB (203 MB). Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1
  • GHSA-w3w8-r2xc-3rp3 / CVE-2024-58381 (pmmp/pocketmine-mp, deserialization, 2026-09-09): game server (Minecraft Bedrock), not a web application; old vulnerability (CVE-2024-58381); the impact is denial of service. PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON
  • GHSA-cw46-936q-fjcf / CVE-2026-57777 (woocommerce/woocommerce, injection, 2026-09-04): repo over ~150 MB (932 MB). Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
  • GHSA-xf4v-vq77-2rgv / CVE-2026-84694 (coollabsio/coolify, injection, 2026-09-02): advisory names no vulnerable file or function (only 'environment variable key names in Docker commands'). Coolify before 4.2.0 fails to properly escape environment variable key names in Docker com
  • GHSA-46j6-w3hw-4r9x / CVE-2026-71981 (cypht-org/cypht, deserialization, 2026-09-01): advisory names no vulnerable file or function (only 'the back_query GET parameter of the logout handler'); the fix is known (e4aa2f34, merge of PR #2073) — the nearest alternate for deserialization if the naming rule is relaxed. Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticate
  • GHSA-v64j-pgc3-qgc9 / CVE-2026-82668 (klaussilveira/gitlist, injection, 2026-08-31): taken as gitlist-commandline-cmdi. A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by thi
  • GHSA-j8xc-7c27-7wj4 / CVE-2026-81728 (dolibarr/dolibarr, injection, 2026-08-27): repo over ~150 MB (1705 MB). Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wiz
  • GHSA-xf89-whcw-pq6g / CVE-2020-15878 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv
  • GHSA-2658-wj4j-m387 / CVE-2020-15876 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv
  • GHSA-6h76-35rh-gxm9 / CVE-2026-80428 (ilias-elearning/ilias, deserialization, 2026-08-26): repo over ~150 MB (3341 MB). ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-
  • GHSA-4rvx-xf2v-6r64 / CVE-2020-15874 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv
  • GHSA-5w6r-2mxc-fq3v / CVE-2026-75497 (qloapps/qloapps, injection, 2026-08-25): taken as qloapps-customermessage-bo-query-sqli. Webkul QloApps does not validate request parameters before a database query. A remote,...
  • GHSA-mj48-jjc7-6wqr / CVE-2026-75498 (qloapps/qloapps, injection, 2026-08-25): one case per repository (repository taken as qloapps-customermessage-bo-query-sqli). Webkul QloApps does not validate request parameters before a database query. A remote,...
  • GHSA-8x6f-m45x-3rjp / CVE-2026-71905 (volmarg/personal-management-system, injection/path, 2026-08-24): corrupt advisory record: the description is about DrayTek VigorAP routers, not this repository. Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSet
  • GHSA-2c9p-fq48-6545 / CVE-2026-75007 (roundcube/roundcubemail, injection, 2026-08-17): advisory names no vulnerable file or function (only 'the LDAP search filter ... %u/%fu/%d substitution'). In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subj
  • GHSA-m462-3x7r-5r7f / CVE-2026-75002 (roundcube/roundcubemail, injection, 2026-08-17): advisory names no vulnerable file or function (only 'mail search and LITERAL+ byte-count desynchronization'). In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-c
  • GHSA-q5rh-mmp4-ppgq / CVE-2026-74997 (roundcube/roundcubemail, injection, 2026-08-17): taken as roundcube-markasjunk-cmd-learn-rce. In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the mar
  • GHSA-4x4q-mx3g-g3m2 / CVE-2026-73680 (cockpit-hq/cockpit, injection, 2026-08-14): advisory names no vulnerable file or function in the repository (only the library call Process::fromShellCommandline() and 'the FFmpeg integration'). Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg inte
  • GHSA-w54w-xf28-wf79 / CVE-2026-71248 (harsh21patel/inventory-management-system-php, injection, 2026-08-05): personal/student project (harsh21patel/inventory-management-system-php), not a maintained application. Inventory-Management-System-PHP's login.php constructs its authentication query via direct
  • GHSA-cv48-22qx-mpmx / CVE-2026-71232 (magicblack/maccms10, injection, 2026-08-05): taken as maccms10-template-blacklist-rce. MacCMS10's admin template editor (application/admin/controller/Template.php) blocks danger

Passed over (not examined; family quota already met): GHSA-5528-3vrx-6443 (octobercms/october, untrusted_destination, 2026-09-28); GHSA-g8jm-3grw-8wh2 (cotonti/cotonti, untrusted_destination, 2026-09-26); GHSA-gmhw-pxmg-j22w (jamesheinrich/getid3, untrusted_destination, 2026-09-20); GHSA-gp9j-h9gm-p3q2 (cotonti/cotonti, untrusted_destination, 2026-09-18); GHSA-5p43-vwpq-wm4q (cotonti/cotonti, untrusted_destination, 2026-09-18); GHSA-w83g-wg62-w3qm (laradashboard/laradashboard, untrusted_destination, 2026-09-09); GHSA-pmmj-hr44-h52v (ilias-elearning/ilias, path, 2026-08-31); GHSA-wvjm-58fp-5q8g (yaojingang/geoflow, untrusted_destination, 2026-08-31); GHSA-gf7h-mv4h-gg7c (yaojingang/geoflow, path, 2026-08-31); GHSA-jgch-2jr2-87vj (dolibarr/dolibarr, path, 2026-08-27); GHSA-g95v-m725-f6xc (volmarg/personal-management-system, path, 2026-08-27); GHSA-gqr6-9g7c-7g7r (wintercms/winter, path, 2026-08-25); GHSA-j9wc-mrp3-532h (hieventsdev/hi.events, untrusted_destination, 2026-08-24); GHSA-7994-gr8j-h7xp (openemr/openemr, path, 2026-08-19); GHSA-vf28-qp34-hhm8 (roundcube/roundcubemail, untrusted_destination, 2026-08-17); GHSA-qf4h-jxxc-wvr9 (getgrav/grav, path, 2026-08-14); GHSA-qrrp-6pvj-xfvf (rconfig/rconfig, path, 2026-08-12); GHSA-f3gp-9xr4-qmvc (joomla/joomla-cms, path, 2026-08-12); GHSA-7gmf-8rwv-m7jc (ayecode/geodirectory, path, 2026-08-11); GHSA-8879-fh4f-q3qm (krayin/laravel-crm, injection, 2026-08-03); GHSA-pw6j-6h33-fv96 (ayecode/invoicing, path, 2026-08-01); GHSA-rfxf-9pcf-q3rq (leantime/leantime, untrusted_destination, 2026-07-30); GHSA-pjx9-wh57-j26p (leantime/leantime, untrusted_destination, 2026-07-30); GHSA-frjf-677q-65jf (misp/misp, untrusted_destination, 2026-07-28); GHSA-hc3p-4h64-j8wr (getgrav/grav-plugin-api, path, 2026-07-23); GHSA-9wvj-rhhh-8292 (simplemachines/smf, untrusted_destination, 2026-07-14); GHSA-5q79-cfqm-5cxh (roundcube/roundcubemail, untrusted_destination, 2026-07-14); GHSA-cfx5-q5qm-x936 (cockpit-hq/cockpit, path, 2026-07-14); GHSA-9fmc-j924-ghh2 (plank/laravel-mediable, untrusted_destination, 2026-07-13); GHSA-j69f-3cmp-jrjj (ayecode/userswp, path, 2026-07-09); GHSA-7793-hmg3-gh57 (librebooking/librebooking, path, 2026-07-09); GHSA-4crx-2rrv-xxcf (horde/vfs, injection, 2026-07-08); GHSA-qfr5-75q5-g2c7 (kirilkirkov/ecommerce-codeigniter-bootstrap, path, 2026-07-04); GHSA-jf5m-wm8f-5pq9 (kirilkirkov/ecommerce-codeigniter-bootstrap, untrusted_destination, 2026-07-04); GHSA-r5xq-x4r6-7g6x (kirilkirkov/ecommerce-codeigniter-bootstrap, path, 2026-07-04); GHSA-233w-5rfj-8hmj (myvesta/vesta, injection, 2026-07-04); GHSA-cr5v-q482-32fc (phpipam/phpipam, path, 2026-07-04); GHSA-cgfv-42v7-7f53 (notifiarr/dockwatch, injection, 2026-07-02); GHSA-mv7w-qwqh-w2g9 (horde/imp, path, 2026-07-01); GHSA-2852-jv28-2mv8 (dolibarr/dolibarr, injection, 2026-06-30); GHSA-w5j4-x499-pfwp (frontaccountingerp/fa, injection, 2026-06-29); GHSA-8ccm-j5hq-9jhr (frontaccountingerp/fa, injection, 2026-06-29); GHSA-53v3-ffpm-f9hw (frontaccountingerp/fa, injection, 2026-06-29); GHSA-9fmm-h59x-wr53 (frontaccountingerp/fa, path, 2026-06-29); GHSA-7v9f-64q7-x2jg (misp/misp, injection, 2026-06-22); GHSA-qrw9-xj5g-qxw8 (chilek/lms, injection, 2026-06-18); GHSA-765c-7qf8-cw9w (chilek/lms, injection, 2026-06-18); GHSA-c4wp-7485-699w (misp/misp, path, 2026-06-12); GHSA-83v9-496w-54wx (wpusermanager/wp-user-manager, path, 2026-06-06); GHSA-9gjj-gmcx-6fhj (misp/misp, untrusted_destination, 2026-06-04); GHSA-rx96-8w86-5hhh (misp/misp, untrusted_destination, 2026-06-04); GHSA-93rv-mf2v-vv2r (php-censor/php-censor, injection, 2026-06-01).

Lane C: deserialization (WordPress and other PHP products without a GitHub fix reference)

  • GHSA-ggx5-r53p-pf97 / CVE-2026-86841 (WordPress plugin, deserialization, 2026-09-27): advisory names no vulnerable function or file. The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does no
  • GHSA-j2rf-55r9-c5ph / CVE-2026-80513 (WordPress plugin, deserialization, 2026-09-24): advisory names no vulnerable function or file (only 'a user-supplied profile field value'). The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be inst
  • GHSA-jvgp-rj42-qjww / CVE-2026-91827 (WordPress plugin, deserialization, 2026-09-22): advisory names no vulnerable function or file; Ninja Forms has no public development repository. _The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values _
  • GHSA-wq6q-gx9m-7669 / CVE-2026-19658 (WordPress plugin, deserialization, 2026-09-22): advisory names no vulnerable function or file. The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versio
  • GHSA-gjf4-862p-rg96 (Softaculous Virtualizor, deserialization, 2026-09-22): proprietary product, no public repository.
  • GHSA-mwgw-rr28-m856 (CuteNews 2.1.2, deserialization, 2026-09-21): no fix diff (the advisory links only the master blob of core/core.php and a disclosure repository; cutenews/cutenews-2.0 has no commit since 2026-06).
  • GHSA-3wpx-h7q2-mv8g / CVE-2026-85017 (WordPress plugin, deserialization, 2026-09-20): advisory names no vulnerable function or file (an unnamed AJAX action). The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a cap
  • GHSA-mqfm-qx5g-96vc / CVE-2026-17086 (WordPress plugin, deserialization, 2026-09-18): advisory names no vulnerable function or file. The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress
  • GHSA-cg5c-mg8j-jqc2 / CVE-2026-78175 (WordPress plugin, deserialization, 2026-09-12): no single identifiable fix diff: in themeum/tutor the withdraw-field fix was committed (0f0b2b20), reverted (0f730b86), re-applied as an empty commit (1da79c03) and followed by 642c8f5c, all on a branch merged with several unrelated security fixes. The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to
  • GHSA-4q25-cq4p-f83q / CVE-2026-78006 (WordPress plugin, deserialization, 2026-09-12): repo over ~150 MB (the-events-calendar/the-events-calendar, 153 MB per GitHub API). The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all
  • GHSA-w3rx-h7m8-2ggf / CVE-2026-84099 (WordPress plugin, deserialization, 2026-09-12): advisory names no vulnerable function or file (an unnamed bundled add-on). The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated ac
  • GHSA-mv63-gmf8-5x76 / CVE-2026-82845 (WordPress plugin, deserialization, 2026-09-12): advisory names no vulnerable function or file. The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values hel
  • GHSA-3237-mv84-xmm9 / CVE-2026-82925 (WordPress plugin, deserialization, 2026-09-10): advisory names no vulnerable function or file. The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being de
  • GHSA-3xv5-w7r3-9wj8 (FileRun, deserialization, 2026-09-10): proprietary product, no public repository.
  • GHSA-7jv8-f84m-pq5j / CVE-2026-11363 (WordPress plugin, deserialization, 2026-09-09): advisory names no vulnerable function or file; no public development repository. The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vul
  • GHSA-2phq-cm26-22pm (MaxSite CMS, deserialization, 2026-09-09): no fix diff (maxsite/cms has no fix commit after the 2026-09-08 disclosure).
  • GHSA-mmpp-99gg-2rq8 / CVE-2026-16502 (WordPress plugin, deserialization, 2026-09-08): advisory names no vulnerable function or file. The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to P
  • GHSA-v38w-pf7m-c3pr / CVE-2026-10196 (WordPress plugin, deserialization, 2026-09-05): function named (handle_form_submission) but no public development repository (GitHub has only an SVN mirror, common-repository/mail-mint, last push 2024). _The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin _
  • GHSA-fq25-6gpx-5vxf / CVE-2026-19887 (WordPress plugin, deserialization, 2026-09-05): function named (usces_action_acting_transaction) but no development repository (only SVN mirrors of usc-e-shop). The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all v
  • GHSA-xw87-h6v2-j87m / CVE-2023-3360 (WordPress plugin, deserialization, 2026-09-02): republished old vulnerability (CVE-2023-3360). The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an importe
  • GHSA-f6hp-2qj5-48vv / CVE-2026-19116 (WordPress plugin, deserialization, 2026-09-02): advisory names no vulnerable function or file. The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field val
  • GHSA-w8mx-gm67-wrqq / CVE-2026-76547 (WordPress plugin, deserialization, 2026-08-29): advisory names no vulnerable function or file. The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data
  • GHSA-j5mw-m2j3-5747 / CVE-2026-14558 (WordPress plugin, deserialization, 2026-08-28): advisory names no vulnerable function or file. The User Frontend WordPress plugin before 4.3.10 does not properly validate field type de
  • GHSA-rm66-h7v3-77rx / CVE-2026-78572 (WordPress plugin, deserialization, 2026-08-25): advisory names no vulnerable function or file. The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versio
  • GHSA-89vc-p8p8-f8q8 / CVE-2026-32563 (WordPress plugin, deserialization, 2026-08-25): advisory names no vulnerable function or file (Patchstack one-line record). _Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= _
  • GHSA-mj2c-4qfw-rhhc (TYPO3 extension (unnamed), deserialization, 2026-08-25): advisory names neither the extension's repository nor a function.
  • GHSA-r2vh-j53r-xpr5 (TYPO3 extension (Apache Solr for TYPO3), deserialization, 2026-08-25): no function or file named (only content object types), no fix link.
  • GHSA-fgg6-3rw5-h3j8 / CVE-2026-0551 (WordPress plugin, deserialization, 2026-08-23): advisory names no vulnerable function or file (only the 'post_protection_roles' parameter). The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injecti
  • GHSA-hpc2-mqfw-fq4q / CVE-2026-4703 (WordPress plugin, deserialization, 2026-08-22): advisory names no vulnerable function or file. _The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to _
  • GHSA-p6x4-h8m9-9mr2 / CVE-2024-13784 (WordPress plugin, deserialization, 2026-08-16): republished old vulnerability (CVE-2024-13784); advisory names no vulnerable function or file. The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vuln
  • GHSA-v2rq-f773-w46v / CVE-2026-10035 (WordPress plugin, deserialization, 2026-08-16): function named (wvrbbp_set_to_serialized_values()) but no development repository (only the SVN mirror common-repository/weaver-for-bbpress). The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Inject
  • GHSA-q83h-6954-x259 / CVE-2026-16099 (WordPress plugin, deserialization, 2026-08-16): taken as wp-podlove-generation-guard-poi. The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletio
  • GHSA-jxc3-pfg8-hv86 / CVE-2026-16267 (WordPress plugin, deserialization, 2026-08-08): advisory names no vulnerable function or file. The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when un
  • GHSA-m7vw-4232-p79x / CVE-2026-16258 (WordPress plugin, deserialization, 2026-08-07): advisory names no vulnerable function or file. _The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization _
  • GHSA-rm37-v7mc-6795 (Cotonti, deserialization, 2026-08-05): third Cotonti comments deserialization record; no merged fix (see lane B).
  • GHSA-jm66-348j-qvv2 (MaxSite CMS, deserialization, 2026-08-04): no fix diff.
  • GHSA-5953-j744-chvm / CVE-2026-16297 (WordPress plugin, deserialization, 2026-08-03): advisory names no vulnerable function or file. The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed whe
  • GHSA-w2rh-rmh8-jmwq / CVE-2025-15672 (WordPress plugin, deserialization, 2026-08-03): republished old vulnerability (CVE-2025-15672); advisory names no vulnerable function or file. The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before p
  • GHSA-xh9j-gpmv-5c2v / CVE-2026-16062 (WordPress plugin, deserialization, 2026-08-02): advisory names no vulnerable function or file. _The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent _
  • GHSA-rpvq-6gf9-58vg / CVE-2026-12720 (WordPress plugin, deserialization, 2026-07-31): advisory names no vulnerable function or file; themeum/kirki has no 6.x code (v2 research). The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantia
  • GHSA-95g3-wxff-cpfp / CVE-2026-1360 (WordPress plugin, deserialization, 2026-07-30): function named (bp_unserialize_profile_field()), but no fix commit is identifiable in buddypress/buddypress (history of src/bp-xprofile/bp-xprofile-functions.php from 2026-06 shows only coding-standard and PHPDoc commits); the repo is taken anyway by wp-buddypress-messages-rest-idor. _The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in _
  • GHSA-4f62-78r3-84fq (Joomla extension Aimy Captcha-Less Form Guard, deserialization, 2026-07-29): commercial extension, no public repository.
  • GHSA-2hhm-rw5g-m2vq / CVE-2026-15962 (WordPress plugin, deserialization, 2026-07-26): advisory names no vulnerable function or file. The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injectio
  • GHSA-m5q4-xwgp-qwg2 / CVE-2026-15008 (WordPress plugin, deserialization, 2026-07-16): fix only inside a whole-release commit (UncannyOwl/Uncanny-Automator ec5fde67 'v7.4.0'). The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin p
  • GHSA-cxqr-jhpf-63mm / CVE-2026-12583 (WordPress plugin, deserialization, 2026-07-14): advisory names no vulnerable function or file. The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted
  • GHSA-ww5c-p3qw-8xxf / CVE-2026-12240 (WordPress plugin, deserialization, 2026-06-30): no development repository on GitHub (only unrelated or stale repositories named export-user-data). _The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to _
  • GHSA-46p4-p677-cfjc / CVE-2025-69130 (WordPress plugin, deserialization, 2026-06-17): advisory names no vulnerable function or file (Patchstack one-line record, a commercial theme). Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress T
  • GHSA-v8h4-8wcw-7gjp / CVE-2026-12115 (WordPress plugin, deserialization, 2026-06-17): advisory names no vulnerable function or file. The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPr
  • GHSA-r622-c48h-h6qq / CVE-2026-8365 (WordPress plugin, deserialization, 2026-06-09): function named (blocksy_sanitize_post_meta_options()) but no public development repository for the Blocksy theme was found. The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Co
  • GHSA-4jj4-xwhh-x5m2 / CVE-2026-7566 (WordPress plugin, deserialization, 2026-06-06): excluded by name (LearnPress add-on); advisory names no vulnerable function or file. _The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object _
  • GHSA-h6x4-229g-5f43 / CVE-2026-7654 (WordPress plugin, deserialization, 2026-06-06): taken as wp-admin-columns-ids-to-collection-poi. The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Re
Reference in New Issue View Git Blame Copy Permalink