Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (als

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce t

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects

历史摘要 · 未重新核验 · GitHub Advisory

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

CVE-2026-59933

## Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detectin

历史摘要 · 未重新核验 · GitHub Advisory

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

CVE-2026-59932

## Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied `.gnumeric` files into memory and, when the file st

历史摘要 · 未重新核验 · GitHub Advisory

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

CVE-2026-59931

### Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypa

历史摘要 · 未重新核验 · GitHub Advisory

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

CVE-2026-59943

### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG render

历史摘要 · 未重新核验 · GitHub Advisory

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

CVE-2026-59942

### Summary Dompdf v3.1.5 is vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can cra

历史摘要 · 未重新核验 · GitHub Advisory

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

CVE-2026-59941

### Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its *declared* header dimension

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: URI fragments disclosed in redirect Referer headers

### Impact When the optional `referer` redirect setting is enabled, affected versions of `RedirectMiddleware` can copy

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Host-only cookie scope is not preserved

### Impact In affected versions, `CookieJar` does not preserve whether a response cookie was set without a `Domain` att

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Unbounded response cookies risk denial of service

### Impact In affected versions, Guzzle's built-in `CookieJar` accepts any number of `Set-Cookie` header fields from on

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

CVE-2026-59883

### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored

历史摘要 · 未重新核验 · GitHub Advisory

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

CVE-2026-59946

## Summary A Composer package declares its executables in the `bin` field of its `composer.json`. When Composer install

历史摘要 · 未重新核验 · GitHub Advisory

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

CVE-2026-59947

## Summary When Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Proxy-Authorization headers can be sent to origin servers

### Impact In affected versions, the built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) put every first-clas

历史摘要 · 未重新核验 · GitHub Advisory

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Cra

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

CVE-2026-55579

### Summary Pheditor ships with a hardcoded default password `admin` (SHA-512 hash stored at `pheditor.php:11`). There

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

CVE-2026-55578

### Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands

历史摘要 · 未重新核验 · GitHub Advisory