12 Oct 2026
6 advisories, 2 critical or high
Two high-severity advisories stand out this week. Unbounded response header buffering in react/http can exhaust memory and cause denial of service. In leantime/...
5 Oct 2026
13 advisories, 2 critical or high
Critical cross-site scripting in contao/comments-bundle leads this week. Update it to 5.3.50 or 5.7.12. In Kunstmaan CMS, authenticated administrators can bypas...
28 Sep 2026
6 advisories, 2 critical or high
This week’s six advisories include two high-severity issues: denial of service in league/commonmark’s GitHub Flavored Markdown Table extension and remote code e...
21 Sep 2026
23 advisories, 15 critical or high
This week’s critical advisory is an unauthenticated account takeover in fof/oauth through unverified email trust in its Discord OAuth provider. Update fof/oauth...
14 Sep 2026
39 advisories, 18 critical or high
Critical SQL injection in cakephp/database and cakephp/cakephp leads this week. Update both packages to the fixed release for your branch: 4.5.12, 4.6.5, 5.1.9,...
7 Sep 2026
15 advisories, 11 critical or high
Critical injection flaws lead this week. predis/predis allows Redis command injection and denial of service through CRLF smuggling in pipelined commands on aggr...