-
Critical cakephp/database, cakephp/cakephp 29M installs
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Fixed in 4.5.12, 4.6.5, 5.1.9, 5.2.14 · CVE-2026-79752
-
Critical getgrav/grav 91K installs
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Fixed in 2.0.15 · CVE-2026-75827
-
Critical getgrav/grav 91K installs
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Fixed in 2.0.15 · CVE-2026-75828
-
Critical chamilo/chamilo-lms
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Fixed in 2.0.1 · CVE-2026-45140
-
High react/http 30M installs
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU
Fixed in 1.11.1 · CVE-2026-84997
-
High mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Fixed in 7.3.0 · GHSA-jr78-w6w5-m8f8
-
High mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Fixed in 7.0.0 · CVE-2025-61682
-
High getgrav/grav 91K installs
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Fixed in 2.0.15 · CVE-2026-74907
-
High getgrav/grav 91K installs
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Fixed in 2.0.14 · CVE-2026-75837
-
High getgrav/grav 91K installs
Grav CMS vulnerable to remote code execution via .zip file upload
Fixed in 2.0.13 · CVE-2026-72819
-
High getgrav/grav 91K installs
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Fixed in 2.0.16 · CVE-2026-72698
-
High getgrav/grav 91K installs
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Fixed in 2.0.16 · CVE-2026-72695
-
High getgrav/grav 91K installs
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Fixed in 2.0.16 · CVE-2026-76846
-
High getgrav/grav 91K installs
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Fixed in 2.0.16 · CVE-2026-76839
-
High getgrav/grav 91K installs
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Fixed in 2.0.16 · CVE-2026-72697
-
High getgrav/grav 91K installs
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Fixed in 2.0.9 · CVE-2026-65608
-
High getgrav/grav 91K installs
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Fixed in 2.0.11 · CVE-2026-69088
-
High getgrav/grav 91K installs
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Fixed in 2.0.11 · CVE-2026-69089
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token
Fixed in 7.2.0 · CVE-2026-77616
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Fixed in 7.2.1 · GHSA-9rcc-pmj8-ffhr
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki has an open redirect in Special:URIResolver
Fixed in 7.2.0 · CVE-2026-77609
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Fixed in 7.2.0 · CVE-2026-77607
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
Fixed in 7.2.0 · CVE-2026-77610
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Fixed in 7.2.0 · CVE-2026-77608
-
Medium mediawiki/semantic-media-wiki 405K installs
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Fixed in 7.2.0 · CVE-2026-77606
-
Medium getgrav/grav 91K installs
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Fixed in 2.0.14 · CVE-2026-75834
-
Medium getgrav/grav 91K installs
Grav: Stored XSS via Markdown audio/video media <source> URL
Fixed in 2.0.15 · CVE-2026-75831
-
Medium getgrav/grav 91K installs
Grav: Stored XSS via quoted-attribute bypass in detectXss
Fixed in 2.0.13 · CVE-2026-72832
-
Medium getgrav/grav 91K installs
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Fixed in 2.0.2 · CVE-2026-61449
-
Medium getgrav/grav 91K installs
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Fixed in 2.0.0 · CVE-2026-58657
-
Medium getgrav/grav 91K installs
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Fixed in 2.0.0 · CVE-2026-59193
-
Medium getgrav/grav 91K installs
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Fixed in 2.0.1 · CVE-2026-61453
-
Medium paymenter/paymenter 29 installs
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Fixed in 1.5.7 · CVE-2026-71537
-
Low october/system 1M installs
October CMS: PHP Object Injection via Backend Widget Session Storage
Fixed in 3.7.17, 4.2.23 · CVE-2026-49400
-
Low october/system 1M installs
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
Fixed in 3.7.17, 4.2.23 · CVE-2026-46696
-
Low october/october 273K installs
October CMS: Incomplete Scheme Validation in Image Resizer
Fixed in 4.3.5 · CVE-2026-100909
-
Low getgrav/grav 91K installs
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Fixed in 2.0.16 · CVE-2026-72701
-
Low getgrav/grav 91K installs
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Fixed in 2.0.16 · CVE-2026-72702
-
Not rated drupal/core 71M installs
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts...
Fixed in 10.6.17, 11.3.17, 11.4.7 · DRUPAL-CORE-2026-013
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.