PatchClock

PHP security digest · Advisories

Security advisories for Composer packages

222 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Advisory Severity
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API snipe/snipe-it · CVE-2026-63498 · 24 Sep 2026 High
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers snipe/snipe-it · CVE-2026-62368 · 24 Sep 2026 High
Snipe-IT: 2FA bypass via the API token flow snipe/snipe-it · CVE-2026-63493 · 24 Sep 2026 High
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration redaxo/source · CVE-2026-62998 · 24 Sep 2026 Medium
Formie: Missing authorization on sent notification resend modal exposes submission PII verbb/formie · CVE-2026-76089 · 23 Sep 2026 High
Formie: Unauthenticated users can overwrite incomplete submissions via submit action verbb/formie · CVE-2026-76087 · 23 Sep 2026 High
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials verbb/formie · CVE-2026-76086 · 23 Sep 2026 High
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) sulu/sulu · CVE-2026-92692 · 23 Sep 2026 Medium
The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML d... drupal/diba_carousel · CVE-2026-96382 · 23 Sep 2026 Not rated
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. T... drupal/smart_content · CVE-2026-96386 · 23 Sep 2026 Not rated
This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently pr... drupal/css_usage_analyzer · CVE-2026-96380 · 23 Sep 2026 Not rated
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when gener... drupal/combined_image_style · CVE-2026-96377 · 23 Sep 2026 Not rated
This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEdi... drupal/ai_ckeditor · CVE-2026-96392 · 23 Sep 2026 Not rated
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities w... drupal/webform_rest · CVE-2026-96391 · 23 Sep 2026 Not rated
This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a perm... drupal/editoria11y · CVE-2026-96390 · 23 Sep 2026 Not rated
This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attac... drupal/tawk_to · CVE-2026-96388 · 23 Sep 2026 Not rated
This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently e... drupal/stop_admin · CVE-2026-96387 · 23 Sep 2026 Not rated
This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requ... drupal/rest_api_authentication · CVE-2026-96385 · 23 Sep 2026 Not rated
This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr... drupal/cookiecuttr · CVE-2026-96379 · 23 Sep 2026 Not rated
This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect defau... drupal/mermaid_diagram_field · CVE-2026-96384 · 23 Sep 2026 Not rated
This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order da... drupal/commerce_decoupled_checkout · CVE-2026-96378 · 23 Sep 2026 Not rated
The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions... drupal/project_browser · CVE-2026-96374 · 23 Sep 2026 Not rated
The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository UR... drupal/cloud · CVE-2026-96376 · 23 Sep 2026 Not rated
The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates... drupal/cloud · CVE-2026-96375 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficientl... drupal/webform · CVE-2026-96355 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently g... drupal/webform · CVE-2026-96356 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficientl... drupal/webform · CVE-2026-96398 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include up... drupal/webform · CVE-2026-96357 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule ca... drupal/webform · CVE-2026-96364 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configur... drupal/webform · CVE-2026-96365 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configu... drupal/webform · CVE-2026-96366 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient... drupal/webform · CVE-2026-96373 · 23 Sep 2026 Not rated
The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Ope... drupal/webform · CVE-2026-96372 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient... drupal/webform · CVE-2026-96371 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON... drupal/webform · CVE-2026-96369 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform... drupal/webform · CVE-2026-96370 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips... drupal/webform · CVE-2026-96368 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient... drupal/webform · CVE-2026-96367 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule c... drupal/webform · CVE-2026-96363 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configur... drupal/webform · CVE-2026-96362 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficientl... drupal/webform · CVE-2026-96359 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating e... drupal/webform · CVE-2026-96358 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient... drupal/webform · CVE-2026-96361 · 23 Sep 2026 Not rated
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript... drupal/webform · CVE-2026-96360 · 23 Sep 2026 Not rated
Solspace Freeform: Limited Twig template injection via submitted field values solspace/craft-freeform · CVE-2026-73858 · 23 Sep 2026 Medium
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost wp-graphql/wp-graphql · CVE-2026-88974 · 23 Sep 2026 Medium
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates redaxo/source · CVE-2026-63000 · 23 Sep 2026 Medium
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames redaxo/source · CVE-2026-63002 · 23 Sep 2026 Medium
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` redaxo/source · CVE-2026-63001 · 23 Sep 2026 Medium
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) paymenter/paymenter · CVE-2026-71537 · 18 Sep 2026 Medium