Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
CVE-2026-56830
## Title Missing authorization on Media sub-form store action allows unpermissioned product media update ## Descriptio
#composer
共收录 517 条相关情报。
← 返回所有主题Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
CVE-2026-56829
## Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component ## Descript
Shopper: privilege escalation via improper Livewire admin component authorization
CVE-2026-56828
## Summary Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.
Shopping privilege escalation through missing authorization in Settings components
CVE-2026-56826
## Summary Four Livewire components in the Settings area expose destructive Filament actions (`delete` / `edit`) that p
Shopper: Negative discount values accepted and propagated through order calculation pipeline
CVE-2026-56831
## Summary The Shopper Framework discount management functionality accepts negative discount values without server-side
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
CVE-2026-56827
## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)
mongodb: Reject "." and NUL bytes in database and collection names
CVE-2026-81525
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database
Composer arbitrary command execution via a malicious package's Perforce source URL
CVE-2026-84361
## Summary If the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allow
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
CVE-2026-84308
The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
CVE-2026-62669
### Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them una
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
CVE-2026-61842
### Summary The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
CVE-2026-61690
## Summary `ZipArchiver::extract()` lacks limits on uncompressed size, file count, and nesting depth, creating a distinc
TYPO3 CMS - Broken Access Control in Backend and Install Tool
CVE-2026-19418
### Problem The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/t
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
CVE-2026-84306
A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be
Filament: Password validity disclosure for accounts denied panel access on login page
CVE-2026-84307
When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating `canAc
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
CVE-2026-77567
A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
### Impact `AttributesExtension` ships with the library but must be explicitly registered on the `Environment`; it is n
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
### Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitl
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
### Summary The `AttributesExtension` documents a security guarantee: > **Note:** Attributes starting with `on` (e.g.
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
### Impact Affected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all o