AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

CVE-2026-33684

## Summary The `set_api_signUp` method in the API plugin accepts `emailVerified`, `canUpload`, `canStream`, and `canCre

历史摘要 · 未重新核验 · GitHub Advisory

Paymenter vulnerable to Remote Code Execution via public file uploads

CVE-2025-58048

### Impact The ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

CVE-2026-55878

### Description The `ux:install` console command installs files from a recipe kit by copying paths listed in a `copy-fil

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

CVE-2026-55877

### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::to

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

CVE-2026-55692

### Summary With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data

历史摘要 · 未重新核验 · GitHub Advisory

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

CVE-2026-55795

### Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET paramet

历史摘要 · 未重新核验 · GitHub Advisory

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

### Summary The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount.

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

CVE-2026-55791

**1. Overview** Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection throug

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

CVE-2026-55691

### Summary The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote t

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

CVE-2026-55690

### Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid serv

历史摘要 · 未重新核验 · GitHub Advisory

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

### Impact `RSACrypt::decryptWithRSA15()` (used by the `RSA1_5` key-encryption algorithm) implements RSAES-PKCS1-v1_5 d

历史摘要 · 未重新核验 · GitHub Advisory

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

## Summary `JWSVerifier::getAlgorithm()` in `src/Library/Signature/JWSVerifier.php` (line 144) merges protected and unp

历史摘要 · 未重新核验 · GitHub Advisory

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

### Impact When a JWE uses a password-based key-encryption algorithm (`PBES2-HS256+A128KW`, `PBES2-HS384+A192KW`, `PBES

历史摘要 · 未重新核验 · GitHub Advisory

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

### Impact The experimental `Chacha20Poly1305` key-encryption algorithm generates the 16-byte Poly1305 authentication t

历史摘要 · 未重新核验 · GitHub Advisory

spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

## Summary `OTPHP\Factory::loadFromProvisioningUri()` parses an attacker-supplied `otpauth://` URI and forwards **every

历史摘要 · 未重新核验 · GitHub Advisory

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

## Summary The `digits` parameter parsed from a provisioning URI is validated only with a lower bound (`$value > 0`) an

历史摘要 · 未重新核验 · GitHub Advisory

CakePHP Authentication: Open redirect weakness via backslash bypass

CVE-2026-55590

### Impact The `getLoginRedirect()` method contains a weakness to backslash bypasses allowing redirect targets with atta

历史摘要 · 未重新核验 · GitHub Advisory

Filament: Disabled RichEditor field state can be used for XSS

CVE-2026-55409

In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in t

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in its Form Framework

CVE-2026-11607

### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form de

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in the Recycler Module

CVE-2026-47349

### Problem Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for t

历史摘要 · 未重新核验 · GitHub Advisory