PatchClock

PHP security digest · Advisories

Security advisories for Composer packages

222 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Advisory Severity
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87951 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87950 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87949 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87948 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87947 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87946 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87945 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87944 · 9 Sep 2026 Not rated
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m... drupal/miniorange_saml · CVE-2026-87943 · 9 Sep 2026 Not rated
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles... drupal/safedelete · CVE-2026-87942 · 9 Sep 2026 Not rated
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view anot... drupal/key_auth · CVE-2026-87940 · 9 Sep 2026 Not rated
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or saniti... drupal/feed_block · CVE-2026-87939 · 9 Sep 2026 Not rated
The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be... drupal/csp_log · CVE-2026-87938 · 9 Sep 2026 Not rated
This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other syst... drupal/cas_server · CVE-2026-87937 · 9 Sep 2026 Not rated
**Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into... drupal/ai_provider_amazeeio · CVE-2026-87936 · 9 Sep 2026 Not rated
mongodb: Reject "." and NUL bytes in database and collection names mongodb/mongodb · CVE-2026-81525 · 8 Sep 2026 High
Composer arbitrary command execution via a malicious package's Perforce source URL composer/composer · CVE-2026-84361 · 8 Sep 2026 High
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery phpseclib/phpseclib · CVE-2026-84308 · 8 Sep 2026 Medium
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections predis/predis · CVE-2026-84372 · 8 Sep 2026 Critical
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver cakephp/cakephp, cakephp/database · CVE-2026-77635 · 8 Sep 2026 Critical
CakePHP: SmtpTransport vulnerable to CRLF header injection cakephp/cakephp · CVE-2026-77634 · 8 Sep 2026 High
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path maatwebsite/excel · CVE-2026-84374 · 8 Sep 2026 High