PatchClock

PHP security digest · Advisories

Security advisories for Composer packages

222 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Advisory Severity
Contao: Improper access control in the preview links module contao/core-bundle · CVE-2026-107850 · 9 Oct 2026 Medium
Contao: Improper access control in the table access voter contao/core-bundle · CVE-2026-107851 · 9 Oct 2026 Medium
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision enshrined/svg-sanitize · CVE-2026-107380 · 8 Oct 2026 Medium
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences enshrined/svg-sanitize · CVE-2026-107381 · 8 Oct 2026 Medium
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash enshrined/svg-sanitize · CVE-2026-107379 · 8 Oct 2026 Medium
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution kunstmaan/media-bundle, kunstmaan/bundles-cms · CVE-2026-104890 · 7 Oct 2026 High
Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not s... drupal/advanced_filesystem · CVE-2026-107262 · 7 Oct 2026 Not rated
This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypas... drupal/restrict_route_by_ip · CVE-2026-107255 · 7 Oct 2026 Not rated
The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Examp... drupal/examples · CVE-2026-107312 · 7 Oct 2026 Not rated
This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mod... drupal/permissions_by_term · CVE-2026-107311 · 7 Oct 2026 Not rated
This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently p... drupal/freelinking · CVE-2026-107310 · 7 Oct 2026 Not rated
This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before... drupal/easy_breadcrumb · CVE-2026-107309 · 7 Oct 2026 Not rated
The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocompl... drupal/country · CVE-2026-107308 · 7 Oct 2026 Not rated
This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for re... drupal/smartlinker_ai · CVE-2026-107307 · 7 Oct 2026 Not rated
This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module doesn't sufficiently sanitize the attributes it... drupal/menu_link_attributes · CVE-2026-107306 · 7 Oct 2026 Not rated
The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables a... drupal/dkan · CVE-2026-107267 · 7 Oct 2026 Not rated
This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal c... drupal/miniorange_2fa · CVE-2026-107268 · 7 Oct 2026 Not rated
This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficien... drupal/xray_audit · CVE-2026-96389 · 7 Oct 2026 Not rated
This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although... drupal/views_share · CVE-2026-107266 · 7 Oct 2026 Not rated
The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does... drupal/leaflet · CVE-2026-107265 · 7 Oct 2026 Not rated
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template inje... drupal/inline_formatter_field · CVE-2026-107264 · 7 Oct 2026 Not rated
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several e... drupal/gutenberg · CVE-2026-107263 · 7 Oct 2026 Not rated
This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may all... drupal/auth_login_plus · CVE-2026-107261 · 7 Oct 2026 Not rated
This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from te... drupal/linked_field · CVE-2026-107259 · 7 Oct 2026 Not rated
This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pag... drupal/inline_entity_form_dialog · CVE-2026-107258 · 7 Oct 2026 Not rated
Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configu... drupal/actstream · CVE-2026-107257 · 7 Oct 2026 Not rated
This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's... drupal/auth_login_plus · CVE-2026-107254 · 7 Oct 2026 Not rated
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you... drupal/orphans_media · CVE-2026-107253 · 7 Oct 2026 Not rated
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module... drupal/mathjax · CVE-2026-107252 · 7 Oct 2026 Not rated
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references acr... drupal/entity_reference_manager · CVE-2026-107251 · 7 Oct 2026 Not rated
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you... drupal/eca_helper · CVE-2026-107250 · 7 Oct 2026 Not rated
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construc... drupal/block_ajax · CVE-2026-107249 · 7 Oct 2026 Not rated
Filament: Multi-factor authentication (app) management actions do not require password reauthentication filament/filament · CVE-2026-104181 · 5 Oct 2026 Medium
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs mongodb/mongodb · CVE-2026-88023 · 5 Oct 2026 Medium
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path composer/composer · CVE-2026-59944 · 2 Oct 2026 Medium
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal league/commonmark · CVE-2026-105829 · 30 Sep 2026 Medium
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan league/commonmark · CVE-2026-105830 · 30 Sep 2026 High
Laravel: XSS in Debug Page Information laravel/framework · CVE-2026-102279 · 29 Sep 2026 Low
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter league/flysystem · CVE-2026-102601 · 29 Sep 2026 Low
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() phpcsstandards/phpcsutils · CVE-2026-65954 · 29 Sep 2026 High
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider fof/oauth · CVE-2026-92161 · 25 Sep 2026 Critical
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled starcitizenwiki/embedvideo · CVE-2026-57440 · 25 Sep 2026 High
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute code16/sharp · CVE-2026-61823 · 25 Sep 2026 High
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass code16/sharp · CVE-2026-61825 · 25 Sep 2026 High
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module contao/contao, contao/core-bundle · CVE-2026-57232 · 24 Sep 2026 Low
zbateson/mail-mime-parser has CRLF header injection via attachment filename zbateson/mail-mime-parser · CVE-2026-61815 · 24 Sep 2026 High
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME zbateson/mail-mime-parser · CVE-2026-61816 · 24 Sep 2026 High
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion phpmyfaq/phpmyfaq, thorsten/phpmyfaq · CVE-2026-56738 · 24 Sep 2026 High
phpMyFAQ's two-factor authentication login bypasses the password factor thorsten/phpmyfaq, phpmyfaq/phpmyfaq · CVE-2026-56737 · 24 Sep 2026 High
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission thorsten/phpmyfaq, phpmyfaq/phpmyfaq · CVE-2026-56736 · 24 Sep 2026 High