p PatchFirst

PatchFirst · Latest vulnerabilities

PHP stack vulnerabilities

Vulnerabilities published for PHP in the last 30 days: 194. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
PHP

Vulnerabilities: 7182

  1. GHSA-mhf7-xp6r-6qrc

    Medium · CVSS 6.5Fix available

    Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    ### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment. 2. **The same issue on e

    livewire/livewirePHP
    • Update to 4.4.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-84911

    Low · CVSS 3.1EPSS 0.15%Fix available

    AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    ai (artificial intelligence) drupal/aiPHP
    • Update to 1.3.13
    • Update to 1.4.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-84912

    Medium · CVSS 4.6EPSS 0.15%Fix available

    AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    ai (artificial intelligence) drupal/aiPHP
    • Update to 1.3.13
    • Update to 1.4.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-84913

    Medium · CVSS 4.6EPSS 0.15%Fix available

    AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

    Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

    ai translate drupal/ai_translatePHP
    • Update to 1.3.2
    • Update to 1.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-84915

    Medium · CVSS 4.6EPSS 0.16%Fix available

    Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

    component blocks drupal/component_blocksPHP
    • Update to 1.2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-84923

    Medium · CVSS 6.5EPSS 0.25%Fix available

    Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

    email verification / sms verification / otp verification drupal/otp_verificationPHP
    • Update to 2.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-84924

    Medium · CVSS 5.4EPSS 0.18%Fix available

    Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

    email verification / sms verification / otp verification drupal/otp_verificationPHP
    • Update to 2.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-81163

    Medium · CVSS 5.4EPSS 0.22%Fix available

    Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

    media library importer drupal/media_library_importerPHP
    • Update to 2.1.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-84919

    Medium · CVSS 4.6EPSS 0.16%Fix available

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

    photoswipe - responsive javascript modal image gallery drupal/photoswipePHP
    • Update to 5.0.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-87936

    Medium · CVSS 6.5EPSS 0.21%Fix available

    amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

    amazee.ai private ai provider drupal/ai_provider_amazeeioPHP
    • Update to 1.3.7
    • Update to 1.4.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-87937

    Medium · CVSS 6.5EPSS 0.23%Fix available

    Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

    central authentication system (cas) server drupal/cas_serverPHP
    • Update to 2.0.4
    • Update to 2.1.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-87938

    Not ratedEPSS 0.17%Fix available

    CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

    csp log drupal/csp_logPHP
    • Update to 1.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →