Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

CVE-2026-46637

### Description Several filters in the `twig/*` extras packages are registered with `is_safe => ['all']`, which tells T

历史摘要 · 未重新核验 · GitHub Advisory

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

CVE-2026-46635

### Description The `column` filter passes its input straight to PHP's native `array_column()`. When the array elements

历史摘要 · 未重新核验 · GitHub Advisory

Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

CVE-2026-46634

### Description When the sandbox is enabled selectively via `SourcePolicyInterface` (and not globally), a sandboxed tem

历史摘要 · 未重新核验 · GitHub Advisory

Twig: PHP code injection via `{% use %}` template name

CVE-2026-46633

### Description `Compiler::string()` escapes `"`, `$`, `\`, NUL and TAB when generating PHP double-quoted string litera

历史摘要 · 未重新核验 · GitHub Advisory

twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

CVE-2026-46629

### Description `IntlExtension` memoises every `\IntlDateFormatter` and `\NumberFormatter` it creates in instance-level

历史摘要 · 未重新核验 · GitHub Advisory

Twig: The `spaceless` filter implicitly marks its output as safe

CVE-2026-46628

### Description The `spaceless` filter is registered with `is_safe => ['html']`, which means Twig's autoescaper does no

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

### Summary An authentication bypass vulnerability in phpMyFAQ allows any unauthenticated attacker to reset the password

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: Default Empty API Token Authentication Bypass

### Summary A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categori

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: IDOR Account Takeover

### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated ad

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

### Summary The password reset API can be triggered without authentication and without any out-of-band confirmation ste

历史摘要 · 未重新核验 · GitHub Advisory

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

CVE-2026-45802

### Impact This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-s

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: Authenticated Arbitrary File Read in view/update.php

CVE-2026-45731

### Summary view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file()

历史摘要 · 未重新核验 · GitHub Advisory

Sulu: Used API Keys may be available via Admin API

### Impact The users endpoint controller exposes a project's apiKey field to the logged-in user, provided they have per

历史摘要 · 未重新核验 · GitHub Advisory

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

CVE-2026-45701

### Impact The password reset tokenand API key generation uses a weak cryptographical hash algorithm. ### Patches Fix

历史摘要 · 未重新核验 · GitHub Advisory

Formie: Pre-authenticated server-side template injection in Hidden fields

CVE-2026-45697

### Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that wer

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS: Cross-Site Scripting in ShowConfigController

CVE-2026-2728

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the R

历史摘要 · 未重新核验 · GitHub Advisory

shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

## Impact `CreateOrderFromCartAction::execute` previously created the `Order` row before checking and incrementing the

历史摘要 · 未重新核验 · GitHub Advisory

shopper/framework: Authorization bypass in multiple Livewire admin components

## Impact Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data wi

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CVE-2026-45270

## Summary The `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but pe

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CVE-2026-45139

## Summary The Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on con

历史摘要 · 未重新核验 · GitHub Advisory