Poznaj podatności. Chroń swoje aplikacje.

Niska 09.10.2026

CVE-2026-107848

Contao: Cross-site request forgery w niestandardowych akcjach panelu administracyjnego

Podatność na fałszowanie żądań międzywitrynowych w Contao pozwala na wykonanie modyfikujących stan lub destrukcyjnych akcji panelu administracyjnego, jeśli zalogowany użytkownik otworzy spreparowany adres URL.

Composer

contao/core-bundle

Wysoka 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Composer

snipe/snipe-it

Średnia 16.09.2026

CVE-2026-61453

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Composer

getgrav/grav

Średnia 31.08.2026

CVE-2026-15305

TYPO3 CMS - Unrestricted File Upload in Form Framework

Composer

typo3/cms-form

Średnia 28.08.2026

CVE-2026-55466

Snipe-IT vulnerable to stored XSS via inline-served attachment

Composer

snipe/snipe-it

Średnia 20.08.2026

CVE-2026-79773

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Composer

winter/wn-system-module

Średnia 20.08.2026

CVE-2026-63179

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Composer

winter/wn-backend-module

Wysoka 20.08.2026

CVE-2026-54175

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Composer

backpack/crud

Krytyczna 07.08.2026

CVE-2026-72780

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Composer

craftcms/cms

Wysoka 06.08.2026

CVE-2026-72786

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Composer

craftcms/cms

Wysoka 31.07.2026

CVE-2026-53599

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Composer

redaxo/source

Wysoka 24.07.2026

ghsa-rm67-g9ch-vxff

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Composer

poweradmin/poweradmin

Średnia 22.07.2026

CVE-2026-56722

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Composer

dompdf/dompdf

Wysoka 15.07.2026

CVE-2026-54491

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Composer

phanan/koel

Wysoka 15.07.2026

CVE-2026-54493

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Composer

phanan/koel

Średnia 15.07.2026

CVE-2026-54492

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Composer

phanan/koel

Krytyczna 14.07.2026

CVE-2026-45262

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Composer

facturascripts/facturascripts

Średnia 13.07.2026

CVE-2026-52820

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Composer

kimai/kimai

Średnia 09.07.2026

CVE-2026-53638

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Composer

sylius/sylius

Wysoka 02.07.2026

CVE-2026-49283

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Composer

simplesamlphp/saml2, simplesamlphp/saml2-legacy

Wysoka 26.06.2026

CVE-2026-49260

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Composer

pontedilana/php-weasyprint

Niska 19.06.2026

CVE-2026-49209

symfony/ux-live-component: Denial of service via unbounded batch action requests

Composer

symfony/ux-live-component

Średnia 04.06.2026

CVE-2026-48013

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Composer

shopware/core, shopware/platform

Średnia 04.06.2026

CVE-2026-48016

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Composer

shopware/core, shopware/platform