SimpleSAMLphp has Possible DoS via XPath Transform

CVE-2026-49289

## Summary This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation h

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

CVE-2026-49283

## Summary SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML `Response` as cryptographical

历史摘要 · 未重新核验 · GitHub Advisory

Paymenter has race condition in payWithCredit() that enables credit double-spend

CVE-2026-55219

### Summary The credit payment implementation in `app/Livewire/Invoices/Show.php` executes a pessimistic row lock (`lock

历史摘要 · 未重新核验 · GitHub Advisory

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

CVE-2026-48808

### Description This is a residual bypass of CVE-2026-46635 / GHSA-vcc8-phrv-43wj that only affects sandboxing enabled

历史摘要 · 未重新核验 · GitHub Advisory

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

CVE-2026-48807

### Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguar

历史摘要 · 未重新核验 · GitHub Advisory

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

CVE-2026-48806

### Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguar

历史摘要 · 未重新核验 · GitHub Advisory

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

CVE-2026-48805

### Description The 3.26.0 source-policy hardening changed the signature of `CoreExtension::checkArrow()` to take a boo

历史摘要 · 未重新核验 · GitHub Advisory

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

CVE-2026-54244

### Impact The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and

历史摘要 · 未重新核验 · GitHub Advisory

Statamic Vulnerable to CSV formula injection in form submission exports

CVE-2026-54243

### Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submi

历史摘要 · 未重新核验 · GitHub Advisory

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

CVE-2026-54242

### Impact The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was valida

历史摘要 · 未重新核验 · GitHub Advisory

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user with

历史摘要 · 未重新核验 · GitHub Advisory

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

CVE-2026-49287

### Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same pr

历史摘要 · 未重新核验 · GitHub Advisory

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

CVE-2026-49288

### Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission

历史摘要 · 未重新核验 · GitHub Advisory

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

CVE-2026-49359

### Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` whe

历史摘要 · 未重新核验 · GitHub Advisory

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

CVE-2026-49358

### Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__dest

历史摘要 · 未重新核验 · GitHub Advisory

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

CVE-2026-49286

### Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-s

历史摘要 · 未重新核验 · GitHub Advisory

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

CVE-2026-49262

### Summary The administrative proxy route (`cmsproxy`) in Aimeos Pagible CMS is vulnerable to a Server-Side Request For

历史摘要 · 未重新核验 · GitHub Advisory

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

CVE-2026-49260

### Summary `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `es

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

CVE-2026-54329

### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

CVE-2026-55542

### Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, a

历史摘要 · 未重新核验 · GitHub Advisory