{ "@context": "https://openvex.dev/ns/v0.2.0", "author": "https://tuxcare.com", "role": "Document Creator", "timestamp": "2026-10-30T11:35:00.150371+00:00", "version": 1, "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-view@2.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-view@2.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m7hr-j867-3f34 is fixed in version 2.1.6-p1+tuxcare of zendframework/zend-view.", "vulnerability": { "name": "GHSA-m7hr-j867-3f34" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 affects version 3.61.0-p1+tuxcare of spatie/browsershot, and is fixed in 3.61.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-3192" }, "action_statement": "Vulnerability CVE-2025-3192 affects version 3.61.0-p1+tuxcare of spatie/browsershot, and is fixed in 3.61.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-GCFG-HMWX-WQ5H is fixed in version 0.3.2-p1+tuxcare of nategood/httpful.", "vulnerability": { "name": "GHSA-GCFG-HMWX-WQ5H" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gcfg-hmwx-wq5h does not affect version 0.3.2-p1+tuxcare of nategood/httpful. already_fixed \u2014 The target repository (nategood/httpful v0.3.2-p1+tuxcare) already contains the security fix for GHSA-gcfg-hmwx-wq5h. The vulnerability was that SSL/TLS certificate validation was disabled by default (strict_ssl = false), allowing man-in-the-middle attacks. The fix changes the default to strict_ssl = true, enabling certificate validation. TuxCare backported this fix in commit 588532c on 2026-05...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gcfg-hmwx-wq5h" }, "impact_statement": "already_fixed \u2014 The target repository (nategood/httpful v0.3.2-p1+tuxcare) already contains the security fix for GHSA-gcfg-hmwx-wq5h. The vulnerability was that SSL/TLS certificate validation was disabled by default (strict_ssl = false), allowing man-in-the-middle attacks. The fix changes the default to strict_ssl = true, enabling certificate validation. TuxCare backported this fix in commit 588532c on 2026-05..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50251 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2023-50251" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25117 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2024-25117" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-97m3-52wr-xvv2 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "GHSA-97m3-52wr-xvv2" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/spamspan@7.1.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/spamspan@7.1.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31687 is fixed in version 7.1.4-p1+tuxcare of drupal/spamspan.", "vulnerability": { "name": "CVE-2025-31687" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/access_code@7.1.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/access_code@7.1.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3129 is fixed in version 7.1.1-p1+tuxcare of drupal/access_code.", "vulnerability": { "name": "CVE-2025-3129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/form_builder@7.1.22-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/form_builder@7.1.22-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0749 is fixed in version 7.1.22-p1+tuxcare of drupal/form_builder.", "vulnerability": { "name": "CVE-2026-0749" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v6.4.37-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v6.4.37-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 does not affect version 1.2.2-p2+tuxcare of dompdf/dompdf. already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28368" }, "impact_statement": "already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59943" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p1+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of illuminate/database, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of illuminate/database, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/spamspan@3.2.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/spamspan@3.2.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31687 is fixed in version 3.2.0-p1+tuxcare of drupal/spamspan.", "vulnerability": { "name": "CVE-2025-31687" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 11.4.4-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/filefield_paths@7.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/filefield_paths@7.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1556 is fixed in version 7.1.2-p1+tuxcare of drupal/filefield_paths.", "vulnerability": { "name": "CVE-2026-1556" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nesbot/carbon@1.26.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nesbot/carbon@1.26.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22145 is fixed in version 1.26.6-p1+tuxcare of nesbot/carbon.", "vulnerability": { "name": "CVE-2025-22145" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@7.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@7.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 7.1.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 does not affect version 1.2.2-p1+tuxcare of dompdf/dompdf. already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28368" }, "impact_statement": "already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55554" }, "action_statement": "Vulnerability CVE-2026-55554 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55555" }, "action_statement": "Vulnerability CVE-2026-55555 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-56722" }, "action_statement": "Vulnerability CVE-2026-56722 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59941" }, "action_statement": "Vulnerability CVE-2026-59941 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59942" }, "action_statement": "Vulnerability CVE-2026-59942 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59943" }, "action_statement": "Vulnerability CVE-2026-59943 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 4.8.10-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p1+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-14761" }, "action_statement": "Vulnerability CVE-2025-14761 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p2+tuxcare.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" }, "action_statement": "Vulnerability GHSA-27qh-8cxx-2cr5 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/tfa_basic@7.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/tfa_basic@7.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6816 is fixed in version 7.1.2-p1+tuxcare of drupal/tfa_basic.", "vulnerability": { "name": "CVE-2026-6816" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/protected_pages@7.2.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/protected_pages@7.2.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9551 is fixed in version 7.2.4-p1+tuxcare of drupal/protected_pages.", "vulnerability": { "name": "CVE-2025-9551" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2023-29197" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" }, "action_statement": "Vulnerability GHSA-6fqw-j3vm-7f66 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" }, "action_statement": "Vulnerability GHSA-848f-mph5-9pm9 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" }, "action_statement": "Vulnerability GHSA-8xhv-gqm4-3w99 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" }, "action_statement": "Vulnerability GHSA-v42g-7q2x-cw32 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40476 is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "CVE-2026-40476" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-68jq-c3rv-pcrr is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-68jq-c3rv-pcrr" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fc86-6rv6-2jpm is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-fc86-6rv6-2jpm" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-r7cg-qjjm-xhqq is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-r7cg-qjjm-xhqq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/flag@7.3.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/flag@7.3.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14556 is fixed in version 7.3.9-p1+tuxcare of drupal/flag.", "vulnerability": { "name": "CVE-2025-14556" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 5.4.45-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 5.4.45-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v4.4.44-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v4.4.44-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 4.4.44-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 4.4.44-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-form@2.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-form@2.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gvpp-6jrj-5pqc is fixed in version 2.1.6-p1+tuxcare of zendframework/zend-form.", "vulnerability": { "name": "GHSA-gvpp-6jrj-5pqc" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v7.4.9-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v7.4.9-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-session@2.1.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-session@2.1.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-96c6-m98x-hxjx is fixed in version 2.1.6-p2+tuxcare of zendframework/zend-session.", "vulnerability": { "name": "GHSA-96c6-m98x-hxjx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50251 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2023-50251" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25117 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2024-25117" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-97m3-52wr-xvv2 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "GHSA-97m3-52wr-xvv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 5.7.27-p1+tuxcare of phpunit/phpunit. PHPUnit version 5.7.27 does not contain the vulnerable code path. The PHPT code coverage feature, including the cleanupForCoverage() method that performs unsafe deserialization of .coverage files, was introduced in later versions (between 5.7.x and 6.5.x). This version lacks all code coverage functionality for PHPT tests and never processes .coverage files, making the deserialization vulnerability impossible to trigger.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "PHPUnit version 5.7.27 does not contain the vulnerable code path. The PHPT code coverage feature, including the cleanupForCoverage() method that performs unsafe deserialization of .coverage files, was introduced in later versions (between 5.7.x and 6.5.x). This version lacks all code coverage functionality for PHPT tests and never processes .coverage files, making the deserialization vulnerability impossible to trigger." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-28368" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59943" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/monolog/monolog@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/monolog/monolog@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f57v-q966-7fh6 is fixed in version 1.11.0-p1+tuxcare of monolog/monolog.", "vulnerability": { "name": "GHSA-f57v-q966-7fh6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v5.4.48-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v5.4.48-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/doctrine/orm@2.8.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/doctrine/orm@2.8.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-vjrg-wpm8-rhrw is fixed in version 2.8.3-p1+tuxcare of doctrine/orm.", "vulnerability": { "name": "GHSA-vjrg-wpm8-rhrw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-28368" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55554" }, "action_statement": "Vulnerability CVE-2026-55554 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55555" }, "action_statement": "Vulnerability CVE-2026-55555 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-56722" }, "action_statement": "Vulnerability CVE-2026-56722 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59941" }, "action_statement": "Vulnerability CVE-2026-59941 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59942" }, "action_statement": "Vulnerability CVE-2026-59942 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59943" }, "action_statement": "Vulnerability CVE-2026-59943 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v7.4.9-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v7.4.9-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 affects version 1.1.0-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.1.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2023-29197" }, "action_statement": "Vulnerability CVE-2023-29197 affects version 1.1.0-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.1.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 6.0.2-p1+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 6.0.2-p1+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@3.0.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@3.0.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 3.0.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v5.4.45-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v5.4.45-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/i18n@7.1.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/i18n@7.1.35-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0748 is fixed in version 7.1.35-p1+tuxcare of drupal/i18n.", "vulnerability": { "name": "CVE-2026-0748" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p2+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p2+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-7269 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7269" }, "impact_statement": "CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-32877 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. not_affected \u2014 Target version 2.0.54 already contains the upstream fix for CVE-2024-32877. The vulnerable code pattern (using ENT_NOQUOTES in htmlEncode) was fixed in upstream Yii 2.0.50 (May 30, 2024) by changing the flag to ENT_QUOTES, which properly encodes quote characters and prevents XSS injection through HTML attributes. The fix is present in ErrorHandler.php line 185.", "vulnerability": { "name": "CVE-2024-32877" }, "impact_statement": "not_affected \u2014 Target version 2.0.54 already contains the upstream fix for CVE-2024-32877. The vulnerable code pattern (using ENT_NOQUOTES in htmlEncode) was fixed in upstream Yii 2.0.50 (May 30, 2024) by changing the flag to ENT_QUOTES, which properly encodes quote characters and prevents XSS injection through HTML attributes. The fix is present in ErrorHandler.php line 185." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39850 is fixed in version 2.0.54-p1+tuxcare of yiisoft/yii2-dev.", "vulnerability": { "name": "CVE-2026-39850" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/yajra/laravel-datatables-oracle@10.11.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yajra/laravel-datatables-oracle@10.11.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10705 is fixed in version 10.11.4-p1+tuxcare of yajra/laravel-datatables-oracle.", "vulnerability": { "name": "AIKIDO-2025-10705" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-46743 does not affect version v5.5.1-p1+tuxcare of firebase/php-jwt. not_affected \u2014 The target firebase/php-jwt v5.5.1 is not affected by CVE-2021-46743. The upstream vendor (Google/Firebase) introduced the Key class and algorithm verification defense in v5.5.1 (November 2021), which is the version the target ships. The fix from patch 1 (commit bc0df6440dfe) is present: Key objects bind algorithms to key material, and JWT::decode verifies the JWT's algorithm header matches the...", "vulnerability": { "name": "CVE-2021-46743" }, "impact_statement": "not_affected \u2014 The target firebase/php-jwt v5.5.1 is not affected by CVE-2021-46743. The upstream vendor (Google/Firebase) introduced the Key class and algorithm verification defense in v5.5.1 (November 2021), which is the version the target ships. The fix from patch 1 (commit bc0df6440dfe) is present: Key objects bind algorithms to key material, and JWT::decode verifies the JWT's algorithm header matches the..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 is fixed in version v5.5.1-p1+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2025-45769" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 10.4.2-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p2+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 affects version 3.263.4-p2+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-14761" }, "action_statement": "Vulnerability CVE-2025-14761 affects version 3.263.4-p2+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p2+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 12.4.5-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mailer@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mailer@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45068 is fixed in version v7.4.8-p1+tuxcare of symfony/mailer.", "vulnerability": { "name": "CVE-2026-45068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48555" }, "action_statement": "Vulnerability CVE-2026-48555 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48557" }, "action_statement": "Vulnerability CVE-2026-48557 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 5.4.45-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 affects version 5.4.45-p1+tuxcare of symfony/process, and is fixed in 5.4.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-24739" }, "action_statement": "Vulnerability CVE-2026-24739 affects version 5.4.45-p1+tuxcare of symfony/process, and is fixed in 5.4.45-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 affects version 0.3.10-p2+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-27354" }, "action_statement": "Vulnerability CVE-2024-27354 affects version 0.3.10-p2+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-40194" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 9.5.28-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/webform_multifile@7.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/webform_multifile@7.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12848 is fixed in version 7.1.6-p1+tuxcare of drupal/webform_multifile.", "vulnerability": { "name": "CVE-2025-12848" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 3.1.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2024-27354" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-40194" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p3+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p3+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 7.5.20-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.4.2-p1+tuxcare of guzzlehttp/psr7. Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48998" }, "action_statement": "Vulnerability CVE-2026-48998 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59882" }, "action_statement": "Vulnerability CVE-2026-59882 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v3.4.47-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v3.4.47-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-27354" }, "action_statement": "Vulnerability CVE-2024-27354 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40194" }, "action_statement": "Vulnerability CVE-2026-40194 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.5.6-p1+tuxcare of laminas/laminas-http.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.4.2-p2+tuxcare of guzzlehttp/psr7. Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/shs@7.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/shs@7.1.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4929 is fixed in version 7.1.10-p1+tuxcare of drupal/shs.", "vulnerability": { "name": "CVE-2026-4929" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 6.5.14-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/coffee@7.2.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/coffee@7.2.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-13247 is fixed in version 7.2.3-p1+tuxcare of drupal/coffee.", "vulnerability": { "name": "CVE-2024-13247" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 5.4.12-p1+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 CVE-2016-10074 has already been fixed in target version 5.4.12. The vulnerability allowed command injection via backslash double quote sequences in email addresses. The fix is explicitly present in Swift_Transport_MailTransport class with the _isShellSafe() validation method that blocks shell-unsafe characters including backslash and double quote before passing email addresses to the mail() com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 CVE-2016-10074 has already been fixed in target version 5.4.12. The vulnerability allowed command injection via backslash double quote sequences in email addresses. The fix is explicitly present in Swift_Transport_MailTransport class with the _isShellSafe() validation method that blocks shell-unsafe characters including backslash and double quote before passing email addresses to the mail() com..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 5.4.12-p1+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/link@7.1.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/link@7.1.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 7.1.13-p1+tuxcare of drupal/link.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 3.4.47-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 3.4.47-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/colorbox@2.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/colorbox@2.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3900 is fixed in version 2.1.2-p1+tuxcare of drupal/colorbox.", "vulnerability": { "name": "CVE-2025-3900" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 4.8.10-p2+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v6.4.37-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 affects version v6.4.37-p1+tuxcare of symfony/mime, and is fixed in v6.4.37-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45070" }, "action_statement": "Vulnerability CVE-2026-45070 affects version v6.4.37-p1+tuxcare of symfony/mime, and is fixed in v6.4.37-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mailer@v6.4.34-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mailer@v6.4.34-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45068 is fixed in version v6.4.34-p1+tuxcare of symfony/mailer.", "vulnerability": { "name": "CVE-2026-45068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/colorbox@7.2.19-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/colorbox@7.2.19-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3900 is fixed in version 7.2.19-p1+tuxcare of drupal/colorbox.", "vulnerability": { "name": "CVE-2025-3900" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/view@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/view@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p1+tuxcare of illuminate/view.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/yajra/laravel-datatables-oracle@9.21.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yajra/laravel-datatables-oracle@9.21.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10705 is fixed in version 9.21.2-p1+tuxcare of yajra/laravel-datatables-oracle.", "vulnerability": { "name": "AIKIDO-2025-10705" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2018-1000162 is fixed in version 1.6.4-p1+tuxcare of erusev/parsedown.", "vulnerability": { "name": "CVE-2018-1000162" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2019-10905 does not affect version 1.6.4-p1+tuxcare of erusev/parsedown. Version 1.6.x is NOT affected by CVE-2019-10905. The vulnerability exists only in versions 1.7.0\u20131.7.1 which used a permissive regex pattern ([^`]+)? that captures spaces in code fence infostrings. Version 1.6.x uses the restrictive pattern ([\\w-]+)? that rejects lines with spaces, preventing the attack chain from completing. The regex at line 399 fails to match infostrings like \"javascript extra\", so no code block is created and no class injection occurs. Python regex testing confirms this behavior. The patch commit message \"[1.7.x] Fix spaces in class names\" indicates the fix targets the 1.7.x branch specifically.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-10905" }, "impact_statement": "Version 1.6.x is NOT affected by CVE-2019-10905. The vulnerability exists only in versions 1.7.0\u20131.7.1 which used a permissive regex pattern ([^`]+)? that captures spaces in code fence infostrings. Version 1.6.x uses the restrictive pattern ([\\w-]+)? that rejects lines with spaces, preventing the attack chain from completing. The regex at line 399 fails to match infostrings like \"javascript extra\", so no code block is created and no class injection occurs. Python regex testing confirms this behavior. The patch commit message \"[1.7.x] Fix spaces in class names\" indicates the fix targets the 1.7.x branch specifically." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/polyfill-intl-idn@v1.30.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/polyfill-intl-idn@v1.30.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46644 is fixed in version v1.30.0-p1+tuxcare of symfony/polyfill-intl-idn.", "vulnerability": { "name": "CVE-2026-46644" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 8.4.3-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 6.4.13-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 6.4.13-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/bootstrap_site_alert@7.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/bootstrap_site_alert@7.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3901 is fixed in version 7.1.6-p1+tuxcare of drupal/bootstrap_site_alert.", "vulnerability": { "name": "CVE-2025-3901" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3530 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3530" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3531 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3532 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v6.4.37-p2+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v6.4.37-p2+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31109 is fixed in version 1.8.7p2-1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2022-31109" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29530 is fixed in version 1.8.7p2-1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2023-29530" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/facebook_pixel@7.1.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/facebook_pixel@7.1.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14557 is fixed in version 7.1.1-p1+tuxcare of drupal/facebook_pixel.", "vulnerability": { "name": "CVE-2025-14557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48555" }, "action_statement": "Vulnerability CVE-2026-48555 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48557" }, "action_statement": "Vulnerability CVE-2026-48557 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21544" }, "action_statement": "Vulnerability CVE-2024-21544 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21547" }, "action_statement": "Vulnerability CVE-2024-21547 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21549" }, "action_statement": "Vulnerability CVE-2024-21549 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-1022" }, "action_statement": "Vulnerability CVE-2025-1022 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-1026" }, "action_statement": "Vulnerability CVE-2025-1026 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 4.4.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nesbot/carbon@1.39.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nesbot/carbon@1.39.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22145 is fixed in version 1.39.1-p1+tuxcare of nesbot/carbon.", "vulnerability": { "name": "CVE-2025-22145" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33182 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33182" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33183 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33183" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33942 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 6.4.13-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 affects version 6.4.13-p1+tuxcare of symfony/process, and is fixed in 6.4.13-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-24739" }, "action_statement": "Vulnerability CVE-2026-24739 affects version 6.4.13-p1+tuxcare of symfony/process, and is fixed in 6.4.13-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/term_reference_tree@7.1.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/term_reference_tree@7.1.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4093 is fixed in version 7.1.11-p1+tuxcare of drupal/term_reference_tree.", "vulnerability": { "name": "CVE-2026-4093" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13625 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2020-13625" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34551 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2021-34551" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3603 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2021-3603" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/commerce_paybox@7.1.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/commerce_paybox@7.1.5-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0750 is fixed in version 7.1.5-p1+tuxcare of drupal/commerce_paybox.", "vulnerability": { "name": "CVE-2026-0750" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.4.13-p2+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 is fixed in version 2.4.13-p2+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g does not affect version 2.4.13-p2+tuxcare of zendframework/zendframework. GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "impact_statement": "GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.4.13-p1+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 affects version 2.4.13-p1+tuxcare of zendframework/zendframework, and is fixed in 2.4.13-p2+tuxcare.", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" }, "action_statement": "Vulnerability GHSA-fh7r-58q4-6387 affects version 2.4.13-p1+tuxcare of zendframework/zendframework, and is fixed in 2.4.13-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g does not affect version 2.4.13-p1+tuxcare of zendframework/zendframework. GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "impact_statement": "GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mobiledetect/mobiledetectlib@2.8.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mobiledetect/mobiledetectlib@2.8.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2018-25080 is fixed in version 2.8.12-p1+tuxcare of mobiledetect/mobiledetectlib.", "vulnerability": { "name": "CVE-2018-25080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version 3.6.3-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-81887 affects version 3.6.3-p1+tuxcare of livewire/livewire, and is fixed in 3.6.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-81887" }, "action_statement": "Vulnerability CVE-2026-81887 affects version 3.6.3-p1+tuxcare of livewire/livewire, and is fixed in 3.6.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version 3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version 3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.1.10-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 1.1.10-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.1.10-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2026-102601 affects version 1.1.10-p1+tuxcare of league/flysystem, and is fixed in 1.1.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-102601" }, "action_statement": "Vulnerability CVE-2026-102601 affects version 1.1.10-p1+tuxcare of league/flysystem, and is fixed in 1.1.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.0.70-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 1.0.70-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.0.70-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2026-102601 affects version 1.0.70-p1+tuxcare of league/flysystem, and is fixed in 1.0.70-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-102601" }, "action_statement": "Vulnerability CVE-2026-102601 affects version 1.0.70-p1+tuxcare of league/flysystem, and is fixed in 1.0.70-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2026-81887 affects version v3.6.3-p1+tuxcare of livewire/livewire, and is fixed in v3.6.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-81887" }, "action_statement": "Vulnerability CVE-2026-81887 affects version v3.6.3-p1+tuxcare of livewire/livewire, and is fixed in v3.6.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare" } } ], "timestamp": "2026-10-12T12:27:00.060353+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p3+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare" } } ], "timestamp": "2026-10-12T12:27:00.060353+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.3-p3+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-10-16T15:15:00.151476+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v3.4.47-p1+tuxcare of symfony/yaml. not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v3.4.47-p1+tuxcare of symfony/yaml, and is fixed in v3.4.47-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v3.4.47-p1+tuxcare of symfony/yaml, and is fixed in v3.4.47-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v3.4.47-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v3.4.47-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "CVE-2022-37251 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "CVE-2023-31144 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "CVE-2023-40035 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2024-21622 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "false_positive \u2014 CVE-2024-21622 targets Craft CMS core (craftcms/cms), but this repository contains verbb/feed-me, a Craft CMS plugin. The affected component code (Craft CMS core) is absent from this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-32432 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products.", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "false_positive \u2014 CVE-2025-32432 concerns Craft CMS core (craftcms/cms) versions 3.0.0-RC1 to before 3.9.15. The target repository is Feed Me plugin (verbb/feed-me) version 3.1.17, a different product with independent versioning. This is a wrong-project match caused by version number collision between two separate products." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-10-16T15:15:00.151476+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v3.4.47-p2+tuxcare of symfony/yaml. not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2021-20332 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare. false_positive \u2014 CVE-2021-20332 concerns the MongoDB Rust Driver, but the target repository is the MongoDB PHP Library (mongodb/mongodb) version 1.9.0. This is a wrong-project match - the CVE applies to a different product in a different programming language.", "vulnerability": { "name": "CVE-2021-20332" }, "impact_statement": "false_positive \u2014 CVE-2021-20332 concerns the MongoDB Rust Driver, but the target repository is the MongoDB PHP Library (mongodb/mongodb) version 1.9.0. This is a wrong-project match - the CVE applies to a different product in a different programming language." }, { "status": "affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2021-32050 affects version 1.9.0-p1+tuxcare of mongodb/mongodb and will not be fixed. Security fix is in mongo-c-driver (a C library we don't maintain). PHP picks it up indirectly through the PECL ext-mongodb extension, which ships a new binary bundling the patched libmongoc. mongo-php-library itself receives no source-code change \u2014 a future release may bump its ext-mongodb version requirement, but no direct patch applies here.", "vulnerability": { "name": "CVE-2021-32050" }, "action_statement": "Vulnerability CVE-2021-32050 affects version 1.9.0-p1+tuxcare of mongodb/mongodb and will not be fixed. Security fix is in mongo-c-driver (a C library we don't maintain). PHP picks it up indirectly through the PECL ext-mongodb extension, which ships a new binary bundling the patched libmongoc. mongo-php-library itself receives no source-code change \u2014 a future release may bump its ext-mongodb version requirement, but no direct patch applies here." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-11695 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare. false_positive \u2014 CVE-2025-11695 affects the MongoDB Rust Driver, but this repository is the MongoDB PHP Library. These are separate codebases for different language ecosystems with no code sharing, vendoring, or dependency relationship. The CVE's tlsInsecure parameter logic does not exist in this PHP library.", "vulnerability": { "name": "CVE-2025-11695" }, "impact_statement": "false_positive \u2014 CVE-2025-11695 affects the MongoDB Rust Driver, but this repository is the MongoDB PHP Library. These are separate codebases for different language ecosystems with no code sharing, vendoring, or dependency relationship. The CVE's tlsInsecure parameter logic does not exist in this PHP library." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-81525 is fixed in version 1.9.0-p1+tuxcare of mongodb/mongodb.", "vulnerability": { "name": "CVE-2026-81525" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-88023 affects version 1.9.0-p1+tuxcare of mongodb/mongodb.", "vulnerability": { "name": "CVE-2026-88023" }, "action_statement": "Vulnerability CVE-2026-88023 affects version 1.9.0-p1+tuxcare of mongodb/mongodb." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-x6mc-fgjf-77r7 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-x6mc-fgjf-77r7" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-109413" }, "action_statement": "Vulnerability CVE-2026-109413 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45304" }, "action_statement": "Vulnerability CVE-2026-45304 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 affects version v4.4.45-p2+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-109413" }, "action_statement": "Vulnerability CVE-2026-109413 affects version v4.4.45-p2+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-21T07:26:00.072497+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 6.0.2-p2+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-21T07:26:00.072497+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 6.0.2-p2+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-109413" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p3+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p2+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v2.8.52-p2+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v2.8.52-p2+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v2.8.52-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p1+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45304" }, "action_statement": "Vulnerability CVE-2026-45304 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-4451" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2015-5723" }, "action_statement": "Vulnerability CVE-2015-5723 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-4451" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2012-5657" }, "action_statement": "Vulnerability CVE-2012-5657 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2012-6531" }, "action_statement": "Vulnerability CVE-2012-6531 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-8088" }, "action_statement": "Vulnerability CVE-2014-8088 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-8089" }, "action_statement": "Vulnerability CVE-2014-8089 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2015-5723" }, "action_statement": "Vulnerability CVE-2015-5723 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" }, "action_statement": "Vulnerability GHSA-229x-22xc-2f2w affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" }, "action_statement": "Vulnerability GHSA-2x36-qhx3-7m5f affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" }, "action_statement": "Vulnerability GHSA-9v78-h226-2rmq affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" }, "action_statement": "Vulnerability GHSA-mhpx-3rv8-wrjm affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mtdowling/jmespath.php@2.6.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mtdowling/jmespath.php@2.6.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:36:00.123359+00:00", "status_notes": "Vulnerability CVE-2026-54133 is fixed in version 2.6.1-p1+tuxcare of mtdowling/jmespath.php.", "vulnerability": { "name": "CVE-2026-54133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-3057" }, "action_statement": "Vulnerability CVE-2025-3057 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p8+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p8+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p9+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p9+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p2+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p6+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p6+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p6+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p6+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p6+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p1+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p1+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "action_statement": "Vulnerability GHSA-mj63-m3rc-8ppr affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p4+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p4+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.15.6-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.15.6-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45411 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-24425 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" }, "action_statement": "Vulnerability CVE-2026-24425 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.15.6-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.15.6-p2+tuxcare of twig/twig. not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v2.15.6-p2+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:23:28.883016+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v7.4.10-p1+tuxcare of symfony/http-kernel. not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45075 is fixed in version v7.4.10-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-45075" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10963 does not affect version 6.11.1-p1+tuxcare of firebase/php-jwt. already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "AIKIDO-2025-10963" }, "impact_statement": "already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch." }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2021-46743 affects version 6.11.1-p1+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2021-46743" }, "action_statement": "Vulnerability CVE-2021-46743 affects version 6.11.1-p1+tuxcare of firebase/php-jwt." }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 affects version 6.11.1-p1+tuxcare of firebase/php-jwt, and is fixed in 6.11.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-45769" }, "action_statement": "Vulnerability CVE-2025-45769 affects version 6.11.1-p1+tuxcare of firebase/php-jwt, and is fixed in 6.11.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10963 does not affect version 6.11.1-p2+tuxcare of firebase/php-jwt. already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "AIKIDO-2025-10963" }, "impact_statement": "already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch." }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2021-46743 affects version 6.11.1-p2+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2021-46743" }, "action_statement": "Vulnerability CVE-2021-46743 affects version 6.11.1-p2+tuxcare of firebase/php-jwt." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 is fixed in version 6.11.1-p2+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2025-45769" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51755" }, "action_statement": "Vulnerability CVE-2024-51755 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-24425 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" }, "action_statement": "Vulnerability CVE-2026-24425 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46635" }, "impact_statement": "not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24894 is fixed in version v3.4.49-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2022-24894" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:30:52.972825+00:00", "status_notes": "Vulnerability CVE-2026-45075 affects version v3.4.49-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-45075" }, "action_statement": "Vulnerability CVE-2026-45075 affects version v3.4.49-p1+tuxcare of symfony/http-kernel." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p3+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p3+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability CVE-2025-54068 affects version v3.6.4-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" }, "action_statement": "Vulnerability CVE-2025-54068 affects version v3.6.4-p2+tuxcare of livewire/livewire." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare" } } ], "timestamp": "2026-10-12T11:15:00.056759+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.4-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2024-50342 is fixed in version v6.0.20-p1+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2024-50342" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/image-optimizer@1.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/image-optimizer@1.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:25:14.318468+00:00", "status_notes": "Vulnerability CVE-2024-34515 is fixed in version 1.5.0-p1+tuxcare of spatie/image-optimizer.", "vulnerability": { "name": "CVE-2024-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-30838" }, "action_statement": "Vulnerability CVE-2026-30838 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p2+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p2+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p2+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p2+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p2+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:22:18.734162+00:00", "status_notes": "Vulnerability CVE-2021-3838 affects version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" }, "action_statement": "Vulnerability CVE-2021-3838 affects version 3.1.0-p1+tuxcare of dompdf/dompdf." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2021-3902 affects version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" }, "action_statement": "Vulnerability CVE-2021-3902 affects version 3.1.0-p1+tuxcare of dompdf/dompdf." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2022-0085 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 CVE-2022-0085 (SSRF via redirect following) is NOT present in dompdf 3.1.0. The fix was already included in the upstream 3.1.0 release. The target contains the mitigation (follow_location => false in HTTP context) at src/Options.php:374, which was part of the upstream release onboarded via the \"Snapshot of 3.1.0\" commit. The CVE affects versions prior to 2.0.0; version 3.1.0 is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-0085" }, "impact_statement": "not_affected \u2014 CVE-2022-0085 (SSRF via redirect following) is NOT present in dompdf 3.1.0. The fix was already included in the upstream 3.1.0 release. The target contains the mitigation (follow_location => false in HTTP context) at src/Options.php:374, which was part of the upstream release onboarded via the \"Snapshot of 3.1.0\" commit. The CVE affects versions prior to 2.0.0; version 3.1.0 is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2022-2400 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 CVE-2022-2400 (chroot bypass vulnerability) was fixed by the upstream dompdf vendor in commit 99aeec1 (April 2022) and released in version 2.0.0 (June 2022). The target repository is version 3.1.0-p1+tuxcare, which is based on upstream 3.1.0 (January 2025) that inherited the fix. TuxCare's snapshot of 3.1.0 included the complete URI validation system (validateLocalUri, validateRemoteUri, valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2400" }, "impact_statement": "not_affected \u2014 CVE-2022-2400 (chroot bypass vulnerability) was fixed by the upstream dompdf vendor in commit 99aeec1 (April 2022) and released in version 2.0.0 (June 2022). The target repository is version 3.1.0-p1+tuxcare, which is based on upstream 3.1.0 (January 2025) that inherited the fix. TuxCare's snapshot of 3.1.0 included the complete URI validation system (validateLocalUri, validateRemoteUri, valida..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2022-28368 affects version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-28368" }, "action_statement": "Vulnerability CVE-2022-28368 affects version 3.1.0-p1+tuxcare of dompdf/dompdf." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2022-41343 affects version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" }, "action_statement": "Vulnerability CVE-2022-41343 affects version 3.1.0-p1+tuxcare of dompdf/dompdf." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:22:18.734162+00:00", "status_notes": "Vulnerability CVE-2023-23924 affects version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" }, "action_statement": "Vulnerability CVE-2023-23924 affects version 3.1.0-p1+tuxcare of dompdf/dompdf." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2023-50262 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 Target dompdf v3.1.0 is NOT AFFECTED by CVE-2023-50262. The circular SVG reference detection fix was already included in the upstream 3.1.0 release before TuxCare's onboarding. The fix adds a graph-based cycle detection mechanism ($svgRefs tracking array and detectCircularRef() method) that prevents infinite recursion when chained SVG image references would create a loop. The vulnerable pattern...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-50262" }, "impact_statement": "not_affected \u2014 Target dompdf v3.1.0 is NOT AFFECTED by CVE-2023-50262. The circular SVG reference detection fix was already included in the upstream 3.1.0 release before TuxCare's onboarding. The fix adds a graph-based cycle detection mechanism ($svgRefs tracking array and detectCircularRef() method) that prevents infinite recursion when chained SVG image references would create a loop. The vulnerable pattern..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 Dompdf 3.1.0 is not affected by CVE-2026-59943. The target repository contains comprehensive SVG image reference validation that prevents malicious file:// URIs in SVG elements from reaching the vulnerable code path in the php-svg-lib dependency. The defense mechanism validates all SVG image references against chroot restrictions before passing the SVG to php-svg-lib for rendering, effe...", "vulnerability": { "name": "CVE-2026-59943" }, "impact_statement": "not_affected \u2014 Dompdf 3.1.0 is not affected by CVE-2026-59943. The target repository contains comprehensive SVG image reference validation that prevents malicious file:// URIs in SVG elements from reaching the vulnerable code path in the php-svg-lib dependency. The defense mechanism validates all SVG image references against chroot restrictions before passing the SVG to php-svg-lib for rendering, effe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability CVE-2025-54068 affects version v3.6.4-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" }, "action_statement": "Vulnerability CVE-2025-54068 affects version v3.6.4-p1+tuxcare of livewire/livewire." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:31:40.708330+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.4-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-24425 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" }, "action_statement": "Vulnerability CVE-2026-24425 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46635" }, "impact_statement": "not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p4+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p4+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p4+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p4+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p4+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-46734" }, "action_statement": "Vulnerability CVE-2025-46734 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-30838" }, "action_statement": "Vulnerability CVE-2026-30838 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p1+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p1+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p1+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p1+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p1+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p4+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p5+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p5+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p5+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p5+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p5+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p2+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p2+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:21:01.627334+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v4.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-10-21T09:43:00.135753+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v4.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 CVE-2024-50345 affects symfony/http-foundation's redirect URL validation. This repository is symfony/http-kernel, which depends on http-foundation but does not contain redirect URL creation or validation logic. The vulnerability pattern (inadequate validation of browser-sanitized URLs in redirects) does not exist in http-kernel's own codebase.", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "not_affected \u2014 CVE-2024-50345 affects symfony/http-foundation's redirect URL validation. This repository is symfony/http-kernel, which depends on http-foundation but does not contain redirect URL creation or validation logic. The vulnerability pattern (inadequate validation of browser-sanitized URLs in redirects) does not exist in http-kernel's own codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-10-21T09:43:00.135753+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v4.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The symfony/http-kernel repository does not contain the vulnerable code. CVE-2025-64500 affects the Request class in symfony/http-foundation, which http-kernel uses as a dependency. The vulnerable PATH_INFO interpretation logic that can produce paths without leading '/' exists only in http-foundation's Request class implementation, not in http-kernel's codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "not_affected \u2014 The symfony/http-kernel repository does not contain the vulnerable code. CVE-2025-64500 affects the Request class in symfony/http-foundation, which http-kernel uses as a dependency. The vulnerable PATH_INFO interpretation logic that can produce paths without leading '/' exists only in http-foundation's Request class implementation, not in http-kernel's codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:30:52.972825+00:00", "status_notes": "Vulnerability CVE-2026-45075 affects version v4.4.51-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-45075" }, "action_statement": "Vulnerability CVE-2026-45075 affects version v4.4.51-p1+tuxcare of symfony/http-kernel." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:17:59.746031+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p3+tuxcare of league/commonmark." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2021-32708 affects version 3.33.0-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" }, "action_statement": "Vulnerability CVE-2021-32708 affects version 3.33.0-p1+tuxcare of league/flysystem." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 3.33.0-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.5.8-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-31109 affects version 2.22.0-p1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2022-31109" }, "action_statement": "Vulnerability CVE-2022-31109 affects version 2.22.0-p1+tuxcare of laminas/laminas-diactoros." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29530 is fixed in version 2.22.0-p1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2023-29530" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.15.6-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.15.6-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45411 is fixed in version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51754" }, "action_statement": "Vulnerability CVE-2024-51754 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51755" }, "action_statement": "Vulnerability CVE-2024-51755 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:29:46.208683+00:00", "status_notes": "Vulnerability CVE-2026-24425 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" }, "action_statement": "Vulnerability CVE-2026-24425 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46628" }, "action_statement": "Vulnerability CVE-2026-46628 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46633" }, "action_statement": "Vulnerability CVE-2026-46633 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46635" }, "action_statement": "Vulnerability CVE-2026-46635 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46638" }, "action_statement": "Vulnerability CVE-2026-46638 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.15.6-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-47732" }, "action_statement": "Vulnerability CVE-2026-47732 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.15.6-p1+tuxcare of twig/twig. not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48806" }, "action_statement": "Vulnerability CVE-2026-48806 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48807" }, "action_statement": "Vulnerability CVE-2026-48807 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v2.15.6-p1+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-49981" }, "action_statement": "Vulnerability CVE-2026-49981 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 7.10.0-p3+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.5.8-p4+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p3+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p3+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:20:21.086657+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p3+tuxcare of league/commonmark." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p3+tuxcare of league/commonmark." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p3+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43808" }, "action_statement": "Vulnerability CVE-2021-43808 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p1+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p3+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:29:08.415871+00:00", "status_notes": "Vulnerability CVE-2022-24775 affects version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" }, "action_statement": "Vulnerability CVE-2022-24775 affects version 1.9.1-p2+tuxcare of guzzlehttp/psr7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.9.1-p2+tuxcare of guzzlehttp/psr7. not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p1+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l...", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p7+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p7+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p7+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p7+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p7+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p7+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p5+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p3+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p3+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p3+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p3+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p3+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p3+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p4+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p5+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l...", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:56:43.326000+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55634 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" }, "action_statement": "Vulnerability CVE-2024-55634 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55636 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" }, "action_statement": "Vulnerability CVE-2024-55636 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55637 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" }, "action_statement": "Vulnerability CVE-2024-55637 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55638 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" }, "action_statement": "Vulnerability CVE-2024-55638 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2025-31674 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" }, "action_statement": "Vulnerability CVE-2025-31674 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108514" }, "action_statement": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:33:11.394606+00:00", "status_notes": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-15916" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:33:11.394606+00:00", "status_notes": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-55805" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 10.5.12-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:29:00.136561+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "action_statement": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p2+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10659" }, "action_statement": "Vulnerability AIKIDO-2026-10659 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p1+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p2+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p2+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p6+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p6+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p6+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p6+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p6+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p6+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p6+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p6+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p6+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p4+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p4+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p4+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p4+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p4+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p4+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p5+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p2+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p3+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p3+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p1+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p7+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p7+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:50:17.417044+00:00", "status_notes": "Vulnerability CVE-2015-3154 is a false positive for zendframework/zend-http 2.5.6-p1+tuxcare. false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail.", "vulnerability": { "name": "CVE-2015-3154" }, "impact_statement": "false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.5.6-p1+tuxcare of zendframework/zend-http.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare.", "vulnerability": { "name": "GHSA-cg8w-5jrc-675g" }, "action_statement": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f6p5-76fp-m248 does not affect version 2.5.6-p1+tuxcare of zendframework/zend-http. already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-f6p5-76fp-m248" }, "impact_statement": "already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p5+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p8+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p8+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p3+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p3+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:56:43.326000+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55634 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" }, "action_statement": "Vulnerability CVE-2024-55634 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55636 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" }, "action_statement": "Vulnerability CVE-2024-55636 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55637 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" }, "action_statement": "Vulnerability CVE-2024-55637 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55638 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" }, "action_statement": "Vulnerability CVE-2024-55638 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2025-31674 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" }, "action_statement": "Vulnerability CVE-2025-31674 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108514 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108514" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-15916" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-55805" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 10.5.12-p2+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:57:26.789422+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55634 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" }, "action_statement": "Vulnerability CVE-2024-55634 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55636 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" }, "action_statement": "Vulnerability CVE-2024-55636 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55637 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" }, "action_statement": "Vulnerability CVE-2024-55637 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2024-55638 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" }, "action_statement": "Vulnerability CVE-2024-55638 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2025-31674 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" }, "action_statement": "Vulnerability CVE-2025-31674 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108514 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108514" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:28:26.184111+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 10.6.17-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:29:08.415871+00:00", "status_notes": "Vulnerability CVE-2022-24775 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" }, "action_statement": "Vulnerability CVE-2022-24775 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.9.1-p1+tuxcare of guzzlehttp/psr7. not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.9.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59882" }, "action_statement": "Vulnerability CVE-2026-59882 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.9.1-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p3+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p3+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p2+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10659" }, "action_statement": "Vulnerability AIKIDO-2026-10659 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p1+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p3+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p3+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p1+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p1+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p1+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-6365" }, "action_statement": "Vulnerability CVE-2026-6365 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p1+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2017-14775" }, "action_statement": "Vulnerability CVE-2017-14775 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2017-16894" }, "action_statement": "Vulnerability CVE-2017-16894 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "action_statement": "Vulnerability GHSA-7852-w36x-6mf6 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:50:17.417044+00:00", "status_notes": "Vulnerability CVE-2015-3154 is a false positive for zendframework/zend-http 2.5.6-p2+tuxcare. false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail.", "vulnerability": { "name": "CVE-2015-3154" }, "impact_statement": "false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.5.6-p2+tuxcare of zendframework/zend-http.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cg8w-5jrc-675g is fixed in version 2.5.6-p2+tuxcare of zendframework/zend-http.", "vulnerability": { "name": "GHSA-cg8w-5jrc-675g" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f6p5-76fp-m248 does not affect version 2.5.6-p2+tuxcare of zendframework/zend-http. already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-f6p5-76fp-m248" }, "impact_statement": "already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare" } } ], "timestamp": "2026-10-08T13:06:25.576695+00:00", "status_notes": "Vulnerability CVE-2015-5161 does not affect version 2.5.3-p1+tuxcare of zendframework/zendframework. not_affected \u2014 CVE-2015-5161 affects Zend Framework 2.5.x before 2.5.2. The target is version 2.5.3, released 2016-01-27, which is after the fix version 2.5.2 (released 2015-08-03). The vulnerability was in the zendframework/zendxml dependency (multibyte encoding bypass in Zend_Xml_Security::scan allowing XXE/XEE attacks under PHP-FPM). The fix (commit e0fc119111 by matthew@zend.com) updated the dependency co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5161" }, "impact_statement": "not_affected \u2014 CVE-2015-5161 affects Zend Framework 2.5.x before 2.5.2. The target is version 2.5.3, released 2016-01-27, which is after the fix version 2.5.2 (released 2015-08-03). The vulnerability was in the zendframework/zendxml dependency (multibyte encoding bypass in Zend_Xml_Security::scan allowing XXE/XEE attacks under PHP-FPM). The fix (commit e0fc119111 by matthew@zend.com) updated the dependency co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare" } } ], "timestamp": "2026-10-08T13:06:25.576695+00:00", "status_notes": "Vulnerability CVE-2021-3007 does not affect version 2.5.3-p1+tuxcare of zendframework/zendframework. The target repository (zendframework/zendframework v2.5.3) is a pure meta-package aggregator with no library source code. The vulnerable Zend\\Http\\Response\\Stream class exists in the separate zendframework/zend-http component package (v2.8.4), which is declared as a dependency but NOT vendored in this repository. The target contains only 3 CLI utility scripts that do not use deserialization, Stream classes, or HTTP functionality. The vulnerability pattern is absent because no code in this repository receives serialized data or instantiates Stream objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3007" }, "impact_statement": "The target repository (zendframework/zendframework v2.5.3) is a pure meta-package aggregator with no library source code. The vulnerable Zend\\Http\\Response\\Stream class exists in the separate zendframework/zend-http component package (v2.8.4), which is declared as a dependency but NOT vendored in this repository. The target contains only 3 CLI utility scripts that do not use deserialization, Stream classes, or HTTP functionality. The vulnerability pattern is absent because no code in this repository receives serialized data or instantiates Stream objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 does not affect version 2.5.3-p1+tuxcare of zendframework/zendframework. not_affected \u2014 This repository (zendframework/zendframework 2.5.3-p1+tuxcare) is a metapackage that contains no runtime source code. The CVE describes a URL rewrite exploit in zend-http and zend-feed components where malicious HTTP headers (X-Original-URL, X-Rewrite-URL) can manipulate the request URI to access arbitrary content. However, in Zend Framework 2.5.x, the architecture changed from monolithic (2.4....", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" }, "impact_statement": "not_affected \u2014 This repository (zendframework/zendframework 2.5.3-p1+tuxcare) is a metapackage that contains no runtime source code. The CVE describes a URL rewrite exploit in zend-http and zend-feed components where malicious HTTP headers (X-Original-URL, X-Rewrite-URL) can manipulate the request URI to access arbitrary content. However, in Zend Framework 2.5.x, the architecture changed from monolithic (2.4...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p3+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p3+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p3+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p4+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "action_statement": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p6+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p3+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l...", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:43.737844+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:46:09.826489+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p2+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l...", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:26:43.737844+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.29-p1+tuxcare of laravel/framework, and is fixed in 10.48.29-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.29-p1+tuxcare of laravel/framework, and is fixed in 10.48.29-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:09.826489+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p1+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "action_statement": "Vulnerability CVE-2021-43617 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p1+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p4+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l...", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25271 affects version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" }, "action_statement": "Vulnerability CVE-2022-25271 affects version 9.5.11-p5+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25273 affects version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" }, "action_statement": "Vulnerability CVE-2022-25273 affects version 9.5.11-p5+tuxcare of drupal/core." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2022-25275 affects version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" }, "action_statement": "Vulnerability CVE-2022-25275 affects version 9.5.11-p5+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2022-25277 affects version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" }, "action_statement": "Vulnerability CVE-2022-25277 affects version 9.5.11-p5+tuxcare of drupal/core." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:32:37.090382+00:00", "status_notes": "Vulnerability CVE-2023-5256 affects version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" }, "action_statement": "Vulnerability CVE-2023-5256 affects version 9.5.11-p5+tuxcare of drupal/core." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p5+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:29:00.136561+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "action_statement": "Vulnerability GHSA-7852-w36x-6mf6 affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.28-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p2+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p5+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p4+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p3+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p3+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.51.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p1+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 11.44.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p2+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-36610" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p4+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p4+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p6+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p5+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p7+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p7+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version v7.4.8-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version v7.4.8-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version v7.4.8-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version v7.4.8-p1+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v7.4.8-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for google/protobuf 3.24.4-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6409 is fixed in version 3.24.4-p1+tuxcare of google/protobuf.", "vulnerability": { "name": "CVE-2026-6409" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qjfj-3mm5-vrjg is a false positive for google/protobuf 3.24.4-p1+tuxcare.", "vulnerability": { "name": "GHSA-qjfj-3mm5-vrjg" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for google/protobuf 3.25.9-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6409 is fixed in version 3.25.9-p1+tuxcare of google/protobuf.", "vulnerability": { "name": "CVE-2026-6409" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-10-26T15:32:16.744693+00:00", "status_notes": "Vulnerability GHSA-qjfj-3mm5-vrjg is a false positive for google/protobuf 3.25.9-p1+tuxcare.", "vulnerability": { "name": "GHSA-qjfj-3mm5-vrjg" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-23638 does not affect version 0.16.0-p1+tuxcare of enshrined/svg-sanitize. not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23638" }, "impact_statement": "not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55166 is fixed in version 0.16.0-p1+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2025-55166" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107379 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107379" }, "action_statement": "Vulnerability CVE-2026-107379 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107380 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107380" }, "action_statement": "Vulnerability CVE-2026-107380 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107381 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107381" }, "action_statement": "Vulnerability CVE-2026-107381 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-23638 does not affect version 0.16.0-p2+tuxcare of enshrined/svg-sanitize. not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23638" }, "impact_statement": "not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2025-55166 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2025-55166" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107379 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107380 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107380" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107381 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107381" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.16.1-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.16.1-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v2.16.1-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v2.16.1-p2+tuxcare of twig/twig." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T11:16:40.182397+00:00", "status_notes": "Vulnerability CVE-2024-45411 does not affect version v2.16.1-p2+tuxcare of twig/twig. twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45411" }, "impact_statement": "twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24425 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.16.1-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v2.16.1-p2+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.16.1-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.16.1-p2+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p1+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-68437" }, "action_statement": "Vulnerability CVE-2025-68437 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-27127" }, "action_statement": "Vulnerability CVE-2026-27127 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-28783" }, "action_statement": "Vulnerability CVE-2026-28783 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-29069" }, "action_statement": "Vulnerability CVE-2026-29069 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-32267" }, "action_statement": "Vulnerability CVE-2026-32267 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p12+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 4.4.49-p2+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 4.4.49-p2+tuxcare of symfony/http-foundation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v5.4.50. The vulnerability involved unsafe processing of X-Original-URL and X-Rewrite-URL headers in prepareRequestUri() that allowed attackers to override the request URI for cache poisoning attacks. The fix (complete removal of these header checks) was applied by upstream Symfony in July 2018 across all supported versions. The target v5...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v5.4.50. The vulnerability involved unsafe processing of X-Original-URL and X-Rewrite-URL headers in prepareRequestUri() that allowed attackers to override the request URI for cache poisoning attacks. The fix (complete removal of these header checks) was applied by upstream Symfony in July 2018 across all supported versions. The target v5..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version v5.4.50-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version v5.4.50-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version v5.4.50-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version v5.4.50-p1+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:22:00.252163+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:22:00.252163+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:23:00.098700+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v5.4.50-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 symfony/http-foundation v5.4.50 is not affected by CVE-2026-48736. On version 5.4, the vulnerable PRIVATE_SUBNETS constant (missing IPv6 transition mechanism prefixes) resides in symfony/http-client's NoPrivateNetworkHttpClient class, not in http-foundation. The http-foundation package on v5.4 only provides generic IP checking utilities (IpUtils::checkIp, checkIp4, checkIp6) and does not mainta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 symfony/http-foundation v5.4.50 is not affected by CVE-2026-48736. On version 5.4, the vulnerable PRIVATE_SUBNETS constant (missing IPv6 transition mechanism prefixes) resides in symfony/http-client's NoPrivateNetworkHttpClient class, not in http-foundation. The http-foundation package on v5.4 only provides generic IP checking utilities (IpUtils::checkIp, checkIp4, checkIp6) and does not mainta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p2+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p2+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p11+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 4.4.49-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 4.4.49-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 4.4.49-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 4.4.49-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-50345" }, "action_statement": "Vulnerability CVE-2024-50345 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 2.8.52-p2+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 2.8.52-p2+tuxcare of symfony/http-foundation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 2.8.52-p2+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 4.4.49-p3+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 4.4.49-p3+tuxcare of symfony/http-foundation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.16.1-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.16.1-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v2.16.1-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v2.16.1-p1+tuxcare of twig/twig." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:16:40.182397+00:00", "status_notes": "Vulnerability CVE-2024-45411 does not affect version v2.16.1-p1+tuxcare of twig/twig. twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45411" }, "impact_statement": "twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24425 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.16.1-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v2.16.1-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.16.1-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.16.1-p1+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48806" }, "action_statement": "Vulnerability CVE-2026-48806 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:40:54.166658+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version v6.4.35-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version v6.4.35-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version v6.4.35-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version v6.4.35-p1+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v6.4.35-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 2.8.52-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 2.8.52-p1+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-50345" }, "action_statement": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 2.8.52-p1+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-68437" }, "action_statement": "Vulnerability CVE-2025-68437 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-27127" }, "action_statement": "Vulnerability CVE-2026-27127 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-32267" }, "action_statement": "Vulnerability CVE-2026-32267 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T19:32:51.945373+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:40:54.166658+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:34:15.412814+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T12:41:00.266160+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p4+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p4+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-33495 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" }, "action_statement": "Vulnerability CVE-2023-33495 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-19T17:43:00.093682+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-13T11:38:04.564831+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p13+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-10913 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-10913" }, "action_statement": "Vulnerability CVE-2019-10913 affects version 3.4.47-p3+tuxcare of symfony/http-foundation." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2019-18888 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2019-18888" }, "action_statement": "Vulnerability CVE-2019-18888 affects version 3.4.47-p3+tuxcare of symfony/http-foundation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 3.4.47-p3+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-33495 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" }, "action_statement": "Vulnerability CVE-2023-33495 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-19T17:43:00.093682+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-13T11:38:04.564831+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p9+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p9+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p4+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.3-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.3-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.3-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.3-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p5+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p5+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-33495 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" }, "action_statement": "Vulnerability CVE-2023-33495 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-115935 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-115938 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-33495 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" }, "action_statement": "Vulnerability CVE-2023-33495 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-36260 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-36260" }, "action_statement": "Vulnerability CVE-2023-36260 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-27T15:48:16.904261+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59932" }, "action_statement": "Vulnerability CVE-2026-59932 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59933" }, "action_statement": "Vulnerability CVE-2026-59933 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T15:48:16.904261+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59932" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59933" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-27T15:48:45.669856+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-27T15:48:16.904261+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-34084" }, "action_statement": "Vulnerability CVE-2026-34084 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-35453" }, "action_statement": "Vulnerability CVE-2026-35453 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40296" }, "action_statement": "Vulnerability CVE-2026-40296 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40863" }, "action_statement": "Vulnerability CVE-2026-40863 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40902" }, "action_statement": "Vulnerability CVE-2026-40902 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59932" }, "action_statement": "Vulnerability CVE-2026-59932 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59933" }, "action_statement": "Vulnerability CVE-2026-59933 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108358" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59932 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59932" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59933 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59933" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2015-8379 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" }, "action_statement": "Vulnerability CVE-2015-8379 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 4.4.18-p1+tuxcare of cakephp/cakephp. not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:03:15.587736+00:00", "status_notes": "Vulnerability CVE-2015-8379 does not affect version 5.0.11-p1+tuxcare of cakephp/cakephp. CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-8379" }, "impact_statement": "CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 5.0.11-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 5.0.11-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 5.0.11-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 5.0.11-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 5.0.11-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 5.0.11-p1+tuxcare of cakephp/cakephp." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114508" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p2+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 2.10.24-p2+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p2+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 2.10.24-p2+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 2.10.24-p2+tuxcare of cakephp/cakephp." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-77634" }, "action_statement": "Vulnerability CVE-2026-77634 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 2.10.24-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 2.10.24-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 2.10.24-p1+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48820" }, "action_statement": "Vulnerability CVE-2026-48820 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-77634" }, "action_statement": "Vulnerability CVE-2026-77634 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p6+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p6+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p3+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 2.10.24-p3+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p3+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 2.10.24-p3+tuxcare of cakephp/cakephp." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 2.10.24-p3+tuxcare of cakephp/cakephp." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p3+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." } ], "@id": "urn:sha256:e8abd7f2a09d34935b2f9b78448a6c79d542a9c8e8406e521f4a0e8bdcadfe16" }