PatchClock

PHP security digest · Advisories

Security advisories for Composer packages

222 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Advisory Severity
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks mediawiki/semantic-media-wiki · GHSA-jr78-w6w5-m8f8 · 18 Sep 2026 High
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) mediawiki/semantic-media-wiki · GHSA-9rcc-pmj8-ffhr · 18 Sep 2026 Medium
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token mediawiki/semantic-media-wiki · CVE-2026-77616 · 18 Sep 2026 Medium
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) mediawiki/semantic-media-wiki · CVE-2026-77610 · 18 Sep 2026 Medium
Semantic MediaWiki has an open redirect in Special:URIResolver mediawiki/semantic-media-wiki · CVE-2026-77609 · 18 Sep 2026 Medium
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS mediawiki/semantic-media-wiki · CVE-2026-77607 · 18 Sep 2026 Medium
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) mediawiki/semantic-media-wiki · CVE-2026-77608 · 18 Sep 2026 Medium
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers mediawiki/semantic-media-wiki · CVE-2026-77606 · 18 Sep 2026 Medium
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes mediawiki/semantic-media-wiki · CVE-2025-61682 · 18 Sep 2026 High
Grav CMS vulnerable to remote code execution via .zip file upload getgrav/grav · CVE-2026-72819 · 17 Sep 2026 High
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin getgrav/grav · CVE-2026-75837 · 17 Sep 2026 High
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate getgrav/grav · CVE-2026-75834 · 17 Sep 2026 Medium
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write getgrav/grav · CVE-2026-75827 · 17 Sep 2026 Critical
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS getgrav/grav · CVE-2026-75828 · 17 Sep 2026 Critical
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) getgrav/grav · CVE-2026-74907 · 17 Sep 2026 High
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion getgrav/grav · CVE-2026-72695 · 17 Sep 2026 High
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU react/http · CVE-2026-84997 · 17 Sep 2026 High
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection cakephp/database, cakephp/cakephp · CVE-2026-79752 · 17 Sep 2026 Critical
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content getgrav/grav · CVE-2026-72697 · 17 Sep 2026 High
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet() getgrav/grav · CVE-2026-76839 · 17 Sep 2026 High
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled getgrav/grav · CVE-2026-76846 · 17 Sep 2026 High
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths getgrav/grav · CVE-2026-72698 · 17 Sep 2026 High
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection getgrav/grav · CVE-2026-72701 · 17 Sep 2026 Low
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match getgrav/grav · CVE-2026-72702 · 17 Sep 2026 Low
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution chamilo/chamilo-lms · CVE-2026-45140 · 17 Sep 2026 Critical
Grav: Stored XSS via Markdown audio/video media <source> URL getgrav/grav · CVE-2026-75831 · 17 Sep 2026 Medium
Grav: Stored XSS via quoted-attribute bypass in detectXss getgrav/grav · CVE-2026-72832 · 17 Sep 2026 Medium
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images getgrav/grav · CVE-2026-69089 · 17 Sep 2026 High
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure getgrav/grav · CVE-2026-69088 · 17 Sep 2026 High
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation getgrav/grav · CVE-2026-65608 · 17 Sep 2026 High
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer getgrav/grav · CVE-2026-61449 · 17 Sep 2026 Medium
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav getgrav/grav · CVE-2026-58657 · 16 Sep 2026 Medium
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation getgrav/grav · CVE-2026-61453 · 16 Sep 2026 Medium
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() getgrav/grav · CVE-2026-59193 · 16 Sep 2026 Medium
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts... drupal/core · DRUPAL-CORE-2026-013 · 16 Sep 2026 Not rated
October CMS: Incomplete Scheme Validation in Image Resizer october/october · CVE-2026-100909 · 14 Sep 2026 Low
October CMS: PHP Object Injection via Backend Widget Session Storage october/system · CVE-2026-49400 · 14 Sep 2026 Low
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls october/system · CVE-2026-46696 · 14 Sep 2026 Low
Shopper: Missing authorization on product removal actions in CollectionProducts component shopper/framework · CVE-2026-56825 · 11 Sep 2026 High
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) shopper/framework · CVE-2026-56830 · 11 Sep 2026 Medium
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component shopper/framework · CVE-2026-56829 · 11 Sep 2026 High
Shopper: privilege escalation via improper Livewire admin component authorization shopper/framework · CVE-2026-56828 · 11 Sep 2026 High
Shopping privilege escalation through missing authorization in Settings components shopper/framework · CVE-2026-56826 · 11 Sep 2026 Medium
Shopper: Negative discount values accepted and propagated through order calculation pipeline shopper/framework · CVE-2026-56831 · 11 Sep 2026 Medium
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers shopper/framework · CVE-2026-56827 · 11 Sep 2026 High
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration pimcore/pimcore · CVE-2026-55416 · 10 Sep 2026 High
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, lin... drupal/ultimate_table_field · CVE-2026-87955 · 9 Sep 2026 Not rated
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous us... drupal/term_glossary · CVE-2026-87954 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87953 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87952 · 9 Sep 2026 Not rated