league/commonmark: Denial of service via deeply nested XML output

### Impact `XmlRenderer` pretty-prints XML by emitting depth-proportional indentation whitespace for **every** opening

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Denial of service via colliding heading slugs

### Impact `UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffi

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Denial of service via duplicate footnote definitions

### Impact The Footnote extension records one backref per footnote *reference* and then appends the **entire** backref

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Denial of service via adjacent inline attribute blocks

### Impact With the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribut

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

CVE-2026-71488

### Impact Affected versions of `league/commonmark` can have quadratic time complexity when parsing specially crafted M

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

CVE-2026-71478

## Summary The `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be

历史摘要 · 未重新核验 · GitHub Advisory

Silverstripe: XSS in breadcrumbs in page list view

CVE-2026-54717

### Impact Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view ### Reporter Fase Rai

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Noncanonical host can bypass host-based checks

CVE-2026-69246

### Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separa

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Noncanonical cookie domain keeps subdomain scope

CVE-2026-69245

### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the

历史摘要 · 未重新核验 · GitHub Advisory

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

CVE-2026-54768

## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r

历史摘要 · 未重新核验 · GitHub Advisory

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

CVE-2026-53599

## Summary `rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames th

历史摘要 · 未重新核验 · GitHub Advisory

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

CVE-2026-68501

### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership

历史摘要 · 未重新核验 · GitHub Advisory

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

CVE-2026-68500

### Impact The shop payment webhook `POST /{_locale}/update-payment` (route `sylius_mollie_shop_payment_webhook`) ac

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

CVE-2026-52838

## Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking s

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

CVE-2026-52841

### Summary `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the se

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

CVE-2026-52837

## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::inde

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

CVE-2026-52839

## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, pro

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

CVE-2026-52840

### Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

CVE-2026-55651

### Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to ob

历史摘要 · 未重新核验 · GitHub Advisory

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`.

历史摘要 · 未重新核验 · GitHub Advisory